Decoding a New Elite Cyber Espionage Team

Stealthy and well-heeled hacking group went undetected for five years and wields a massive attack framework of some 80 different modules.

Its an expansive cyber espionage operation that canvasses a victims network with backdoors, loaders, keyloggers, screen and webcam grabbers, and audio recorders, and it even siphons data from printer queues, burned CDs, and Apple iOS smartphone backups.
The so-called TajMahal attack framework operated invisibly for five years until it was uncloaked last fall by researchers at Kaspersky Lab who found it embedded deep in the network of a diplomatic organization in Central Asia, where it had been spying and stealing documents since 2014. TajMahal comes with a whopping 80 different attack modules, including an unusual and rare one that lets the attacker steal specific files from a USB stick when the device is inserted into a computer.
Given the breadth of TajMahals attack arsenal, there are likely other victims that have not yet been identified. Theyre possibly using this framework elsewhere, but were not [able to see] in those organizations. It would be highly unusual for a malware set that looks like this to be for a single use, said Kurt Baumgartner, principal security researcher with Kaspersky Lab, in an interview last week at the Kaspersky Security Analyst Summit in Singapore, where the company shared its findings on TajMahal.
The researchers found no ties between TajMahal to existing nation-state threat groups, nor any similarities in its code base to others. It appears to be a new, previously unknown cyber espionage group thats especially advanced and well resourced and that expects to be well entrenched in a victims network for long periods of time, according to Baumgartner. They actually exfiltrate an entire mobile phone backup — thats something that takes a lot of time.
While TajMahals mobile-theft capability is rare, its also reminiscent of the epic
Red October APT
cyber espionage campaign that Kaspersky Lab first unearthed in 2013. Red October built out modules that were purpose-built for exfiltrating mobile data, Baumgartner said.
Red October stole terabytes of information from computers, smartphones, routers, and VoIP phones of government, diplomatic, and scientific research organizations spanning multiple regions worldwide, and at the time was considered one of the most sophisticated cyber espionage operations in the world.
Baumgartner said TajMahal, with its massive number of plug-in modules, falls into the category of a well-resourced APT like Flame and Duqu, two other infamous cyber espionage attack groups. Another interesting element of TajMahal is its virtual file system (VFS), an indexed and encrypted file system it uses for its attack tools, he said.
Its likely the attackers also have changed IP addresses to evade detection, according to Alexey Shulman, lead malware analyst at Kaspersky Lab. They are probably on other machines that havent yet been discovered, he said.
Tokyo & Yokohama
TajMahal, which was named after the file the attackers use to exfiltrate data, is made up of two main components: Tokyo and Yokohama. Tokyo helps launch the first stage of the attack, and includes three modules, including the main backdoor and command-and-control communication, using PowerShell to remain hidden in the network.
Yokohama is the second stage of the attack, the full-blown spying operation, and uses the attackers VFS with the 80 modules, which also include command-and-control communicators, cryptography key stealers, and browser cookie stealers that target Internet Explorer, Firefox, and Netscape Navigator, for example.
Still unknown, however, is the initial attack or infection vector for TajMahal.
While Kaspersky researchers declined to speculate on which nation-state is behind TajMahal, other experts say its well-resourced and comprehensive attack arsenal indicates that its one of the most advanced APT groups in operation. The modular nature of the code, coupled with advanced persistence features to engage in proximity attacks, makes it truly formidable, says Tom Kellermann, chief cybersecurity officer at Carbon Black. This code is being selectively deployed across the [Central Asia] region and should serve as a harbinger of APTs to come.
TajMahals capabilities demonstrate how cyberattacks can be executed in the physical world as well, Kellermann says, by pilfering data from printer queues, burned CDs, and USBs, and turning on computer microphones and cameras from afar.
While protecting networks from determined nation-states and other advanced attackers is never foolproof, the usual best practices can minimize exposure. Kaspersky Lab recommends schooling users on phishing and social engineering scams, keeping software updated, and employing advanced endpoint security tools.
The researchers also released
indicators of compromise
and other technical details for TajMahal.
Related Content:
MuddyWater APT Spotted Attacking Android
Digital Doppelganger Underground Takes Payment Card Theft to
the Next Level
19
Minutes to Escalation: Russian Hackers Move the Fastest
8 SOC-as-a-Service Offerings

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industrys most knowledgeable IT security experts. Check out the
Interop agenda
here.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Decoding a New Elite Cyber Espionage Team