The Kaspersky Lab
researchers have uncovered a sophisticated threat across 11 countries, used for
cyber-espionage in the Middle East and Africa from at least 2012 until February
2018, reports ITRealms.
The malware, ITRealms
gathered is called ‘Slingshot’, which attacks and infects victims through
compromised routers and can run in kernel mode, giving it complete control over
victim devices.
These countries, ITRealms
also gathered included Kenya, Yemen,
Afghanistan, Libya, Congo, Jordan, Turkey, Iraq, Sudan, Somalia and Tanzania
have been listed among the 100 victims worldwide.
According to researchers, many of the techniques used by
this threat actor are unique and it is extremely effective at stealthy
information gathering, hiding its traffic in marked data packets that it can
intercept without trace from everyday communications.
The Slingshot operation was discovered after researchers
found a suspicious keylogger program and created a behavioural detection
signature to see if that code appeared anywhere else. This triggered a
detection that turned out to be an infected computer with a suspicious file
inside the system folder named scesrv.dll.
In addition, the researchers decided to investigate this
further, just as analysts are of the view that the file showed that despite
appearing legitimate, the scesrv.dll module had malicious code embedded into
it. Since this library is loaded by ‘services.exe’, a process that has system
privileges, the poisoned library gained the same rights. The researchers
realised that a highly advanced intruder had found its way into the very core
of the computer.
The most remarkable thing about Slingshot is probably its
unusual attack vector. As researchers uncovered more victims, they found that
many seemed to have been initially infected through hacked routers. During
these attacks, the group behind Slingshot appears to compromise the routers and
place a malicious dynamic link library inside it that is in fact a downloader
for other malicious components.
When an administrator logs in to configure the router, the
router’s management software downloads and runs the malicious module on the
administrator’s computer. The method used to hack the routers in the first
place remains unknown.
Chuks Egbune/GEE
No comments:
Post a Comment