Targeted data stealing attacks using fake attachments

ESET has uncovered and analyzed a targeted campaign that tries to steal sensitive information from different organizations, particularly in Pakistan (with limited spread around the world).

During the course of ESET investigations several leads were discovered that indicate the threat has its origin in India and has been going on for at least two years.

This targeted attack used a code signing certificate issued to a seemingly legitimate company to sign malicious binaries and improve their potential to spread. The company was based in New Delhi, India and the certificate was issued in 2011. The malware spread through documents attached to emails.

“We have identified several different documents that followed different themes likely to be enticing to the recipients. One of these is the Indian armed forces. We do not have precise information as to which individuals or organizations were really specifically targeted by these files, but based on our investigations, it is our assumption that people and institutions in Pakistan were targeted,” said Jean-Ian Boutin , ESET malware researcher.

For instance, one of the fake PDF files was delivered through a self-extracting archive called “pakistandefencetoindiantopmiltrysecreat.exe”, and ESET telemetry data shows that Pakistan is heavily affected by this campaign with 79 percent of detections being in that country.

The first infection vector was utilizing a widely used and abused vulnerability known as CVE-2012-0158. This vulnerability can be exploited by specially crafted Microsoft Office documents and allows arbitrary code execution. The documents were delivered by email, and the malicious code was executed without the attacked computer user even knowing as soon as the document was opened.

The other infection vector was via Windows executable files appearing to be Word or PDF documents-again distributed via email. In both cases, to evade suspicion by the victim, fake documents are shown to the user on execution.

The malware was stealing sensitive data from infected PCs and sending it to the attackers’ servers. It was using various types of data-stealing techniques, among them a key-logger, taking screenshots and uploading documents to attackers’ computer. Interestingly, the information stolen from an infected computer was uploaded to the attacker’s server unencrypted.

“The decision not to use encryption is puzzling considering that adding basic encryption would be easy and provide additional stealth to the operation,” said Boutin.

This is a multi-part and multi-vector threat, below are ESET threat names related to this case:

Win32/Agent.NLD worm
Win32/Spy.Agent.NZD Trojan
Win32/Spy.Agent.OBF Trojan
Win32/Spy.Agent.OBV Trojan
Win32/Spy.KeyLogger.NZL Trojan
Win32/Spy.KeyLogger.NZN Trojan
Win32/Spy.VB.NOF Trojan
Win32/Spy.VB.NRP Trojan
Win32/TrojanDownloader.Agent.RNT Trojan
Win32/TrojanDownloader.Agent.RNV Trojan
Win32/TrojanDownloader.Agent.RNW Trojan
Win32/VB.NTC Trojan
Win32/VB.NVM TrojanWin32/VB.NWB Trojan
Win32/VB.QPK Trojan
Win32/VB.QTV Trojan
Win32/VB.QTY Trojan
Win32/Spy.Agent.NVL Trojan
Win32/Spy.Agent.OAZ Trojan