Symantec Discovers Strider, A New CyberEspionage Group

In action five years, highly selective threat actor has only been known to compromise seven organizations.

Symantec has discovered
a previously unknown cyberespionage group so selective in its targets that it is only known to have compromised seven organizations and 36 endpoints since it started operating five years ago. Dubbed Strider by Symantec, the threat actors malware of choice is a custom, Windows infostealer called Remsec -- stealthy, modular, and written in Lua.
The seven organizations include targets in Russia, an airline in China, an embassy in Belgium, and an organization in Sweden. DiMaggio says this is an extremely small number of targets, even for a sophisticated actor.
Thats exactly why this is so interesting to us, says Jon DiMaggio, senior threat intelligence analyst at Symantec. ... The fact that someone invested the time and money into creating custom malware and only used it on this many targets. He says targeting this focused means that someone has gone through a lot of trouble and done a lot of reconaissance.
Symantec has not speculated on Striders origins or Remsecs creators, other than to say in todays blog announcing the discovery that it is possible that the group is a nation-state level attacker.
Researchers do acknowledge, however, that the groups attacks have tentative links with earlier cyberespionage malware --
Flame
, highly sophisticated malware that mostly hit targets in the Middle East and was widely thought to derive from Western sources. Remsec and Flame both use modules written in the Lua programming language, which is a rare technique.
DiMaggio says that using Lua is one of the Remsec authors self-protection mechanisms. Common security tools usual logic and detection engines are less likely to find uncommon methods like this. Its the same reason, DiMaggio says, that some components of the Remsec malware are in the form of executable blobs (binary large objects), which are also less common.
Thats what I would do if I was writing malware, says DiMaggio.
Its not the end of Remsecs stealth mechanisms either. According to the Symantec blog, much of the functionality is deployed over the network, meaning it resides only in a computers memory and is never stored on disk.
The Lua modules in Remsec include a network loader, host loader, network listener, basic pipe back door, a more advanced pipe back door that can read, write and delete files), an HTTP back door that includes URLs for a command-and-control server, and a keylogger.
The keylogger contains the word Sauron in the code -- perhaps named after the
Lord of the Rings
character and his famous flaming all-seeing eye. Symantec continued with the
LOTR
theme when they named the threat actor Strider, one of Aragorns alternate names.
For the complete indicators of compromise, see
here
.
Related Content:
DDoS Attacks: Cybercriminals Are More Homegrown Than You Think
Browser Exploits Increasingly Go For The Jugular
Multiple Major Security Products Open To Big Vulns Via Hooking Engines

Last News
▸ Veritabile Defecte de Proiectare a Securitatii in Software -> Top 10 Software Security Design Flaws ◂ Discovered: 23/12/2024 Category: security	▸ Sony, XBox Targeted by DDoS Attacks, Hacktivist Threats ◂ Discovered: 23/12/2024 Category: security	▸ There are plenty of online tools for reporting bugs. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Symantec Discovers Strider, A New CyberEspionage Group