A new cyber espionage campaign targeting energy and military companies and organizations has been unearthed by the researchers of Dell SecureWorks Counter Threat Unit Threat Intelligence.

Dubbed Mirage after the highly persistent Remote Access Tool installed on the targeted machines, the campaign predictably starts with spear-phishing emails aimed at mid-level to senior-level executives. Once the recipients download and run the attachment, they are saddled with the Mirage RAT.

"CTU researchers have identified several files that drop and execute a copy of Mirage onto a target system," says researcher Silas Cutler. "These 'droppers' are designed to look and behave like PDF documents. However, the droppers are stand-alone executable files that open an embedded PDF file and execute the Mirage trojan.

"In one example, CTU researchers observed an executable file that upon execution drops a copy of Mirage and opens an embedded PDF of a news story titled 'Yemeni Women can participate in politics just like men, says President Saleh' that was posted on the Yemen Observer's website.

The attacks have so far been aimed at an oil company in the Phillipines, a military organization in Taiwan, an energy company in Canada, and several as yet unidentified entities in Brazil, Israel, Egypt and Nigeria.

The researchers have analyzed a variety of Mirage variants used in the attacks, and have discovered that some of them had unique attributes not designed for widespread targeting, i.e. that they were custom-made to target specific systems.

Having traced some of the IP addresses connected to the attacks back to a subnet of the Beijing province network, the researchers believe that the attackers are operating from China.

"Traditionally, the success of botnets created by threat actor groups has been measured by the quantity of infected systems and the difficulty to defend against in the long term. These targeted attacks show that a successful campaign requires only small quantity of infected systems to accomplish the attackers' objectives and to yield extremely powerful results," say the researchers.

"For companies in the targeted industries, it is important to have a strong perimeter security line in place. Using active intrusion detection and prevention systems as well as DNS monitoring for malicious domains is essential to detecting this activity."