New Targeted Attack Campaign Against Defense Contractors Under Way

Researchers at Invincea, ThreatGrid discover stealthy attack that lets attackers quietly steal information from victims

The U.S. Defense industry once again is under siege by cyberspies in an attack that provides a link to a rigged spreadsheet containing a real list of high-level defense industry executives who attended a recent Intelligence Advanced Research Projects Activity (IARPA) event.
A Defense contractor friend of Anup Ghosh, CEO of Invincea, sent him a copy of a targeted yet suspicious email with the attachment he had received unsolicited. He said he has been a nonstop target of a lot of spear-phishing attempts, but this one was very compelling because it was purported to have names of attendees to a recent IARPA meeting, Ghosh says. It appears that the attackers sent the same email and malicious attachment to the other 163 event attendees, he says.
The embedded URL -- which appears to be a subdomain of a domain that redirects to the legitimate research project website -- provides a ZIP archive to the attendee roster, which includes the names of directors, presidents, and CEOs of major Defense and intelligence companies.
Unzipped, you see an XLS-looking file, but its actually an executable, Ghosh says. It extracts another custom program thats an HTTP client. This client beacons out to a server. You wouldnt notice it even if you were looking at your system process table: It looks like standard browser activity.
Its not until the system is rebooted, however, that the badness begins: The client reaches out to a command-and-control (C&C) server, which sends it another executable file. Thats the payload of the weapon, he says.
Dean De Beer and his team at ThreatGrid analyzed the executable, and found that its a remote C&C Trojan hosted on a website. That Trojan gives the attackers full control of the victims machine and Internet settings in the registry, and is able to update the root certificate lists that could be used for SSL man-in-the-middle attacks.
The researchers have alerted the targeted victims, as well as other members of the Defense industry and law enforcement.
They are unable to tell just how far the attackers got or what they might have stolen. We would have to hack back into their server, and even then we may not see the actual data. But we dont do that, and we didnt do that, De Beer says. We know the remote command-and-control built-in commands can exfiltrate data.
The attack appears to be an ongoing, active campaign targeting multiple Defense contractors, the researchers say, with similar methods but some different documents and executables. The M.O. was the same, Invinceas Ghosh says.
Others have used different files but use the same outbound URL format as the beaconing URLs used in the IARPA event spear-phish, the researchers say.
The full attack analysis is available in an Invincea blog post
here
.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security	▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂ Discovered: 23/12/2024 Category: security	▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
New Targeted Attack Campaign Against Defense Contractors Under Way