NetTraveler APT group is back, adds watering hole attacks to its arsenal
Posted on 03.09.2013
The "Red Star" APT group employing the NetTraveler malware family is still active, but has changed its modus operandi.


Its targets remain the same: government institutions, embassies, the oil and gas industry, research centers, military contractors and activists.

But, while earlier this year they mostly relied on spear phishing emails to deliver a booby-trapped attachment, now they try to lead users to a booby-trapped site or they inject certain websites with malicious JavaScript that will redirect them to such sites.

"Immediately after the public exposure of the NetTraveler operations, the attackers shutdown all known C2s and moved them to new servers in China, Hong Kong and Taiwan," noted Kaspersky Lab's Costin Raiu. "However, they also continued the attacks unhindered."

The latest round of attacks targets Uyghur activists. Last week, a number of spear-phishing emails have been spotted by the company, purportedly carrying a link pointing to a statement made by the World Uyghur Congress regarding a recent massacre.

Unfortunately, when the victims follow the link, they are taken to a known NetTraveler-related domain, where an exploit for a known and patched Java vulnerability (CVE-2013-2465) is used to drop a backdoor on to their computer. The malware collects information from it and sends it to a previously unknown C&C server.

Another way the group targets those same activists is by compromising the official website of an Uyghur-related website (in this case, the one belonging to the Islamic Association of Eastern Turkistan) and make it redirect to the aforementioned NetTraveler-related domain, where the same infection chain is repeated.

"The usage of the Java exploit for CVE-2013-2465 coupled with watering hole attacks is new, previously unseen development for the NetTraveler group," Raiu points out.

Still, the group has yet to be seen exploiting zero-day vulnerabilities, so for now keeping one's OS, Java and other software updated is enough to prevent becoming a victim.









Spotlight

Biggest ever cyber security exercise in Europe is underway

Posted on 30 October 2014.  |  More than 200 organisations and 400 cyber-security professionals from 29 European countries are testing their readiness to counter cyber-attacks in a day-long simulation, organised by the European Network and Information Security Agency (ENISA).


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Thu, Oct 30th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //