I just joined a leading Cyber-Security company to drive their strategy around Virtualization. Having spent most of my career in VoIP, Switching, Routing and SDN, I wanted to start learning every few days about a new topic in Security..My set of blogs are for my understanding as I peruse the internet.
I saw a recent report released around Scarlet Mimic - A multi-year campaign which aimed at targeting Uighyur and Tibetan Groups and wanted to understand it. The tactics the espionage group used predominantly were Spear-phising (where an email is sent directly with infected code) or water-hole (where a website which people would visit and get infected). Looking into more details around the attack..
An email is sent directly to a end-user with a valid body and from an email address the end-user trusts. For example: one of your contacts sends you an email with a clipping related to an article you care about. The user would open the file - which could be disguised with a valid extension and also display properly. The file would then have target code which would exploit a backdoor vulnerability in Microsoft or Android. The backdoor Trojan is then installed and the command/control traffic can now flow to an external server. In most cases, the traffic is disguised as Windows Messenger/Yahoo! Messenger so that detection by Firewall systems can be avoided.
I like to think about this topic like a rocket launching into space. There is a main payload which is used to send an email to a sender, the next payload detaches and does its work - in this case the loader Trojan such as FakeHighFive, Subtract This etc load the FakeM virus into memory and execute its functional code.
FakeM Command/Control traffic has evolved quite a bit from sending traffic in the clear to encrypting traffic (which can get detected by Firewalls with SSL decryption and App-id capability) to having a variant of SSL handshake (initial Hello not exchanged) to completely avoid detection. FakeM uses Diffie-Helman key exchange and RC4 algorithm for encryption. Once installed, the remote user can easily do anything on the computer (like retrieve files , delete them etc).
To prevent this kind of attack from happening, End-users can install a good Endpoint protection program , Have a good cloud based Malware detection and sandboxing engine to detect Malware and have URL filtering enabled.
Take a look at this link for a more detailed analysis:
http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/
I saw a recent report released around Scarlet Mimic - A multi-year campaign which aimed at targeting Uighyur and Tibetan Groups and wanted to understand it. The tactics the espionage group used predominantly were Spear-phising (where an email is sent directly with infected code) or water-hole (where a website which people would visit and get infected). Looking into more details around the attack..
An email is sent directly to a end-user with a valid body and from an email address the end-user trusts. For example: one of your contacts sends you an email with a clipping related to an article you care about. The user would open the file - which could be disguised with a valid extension and also display properly. The file would then have target code which would exploit a backdoor vulnerability in Microsoft or Android. The backdoor Trojan is then installed and the command/control traffic can now flow to an external server. In most cases, the traffic is disguised as Windows Messenger/Yahoo! Messenger so that detection by Firewall systems can be avoided.
I like to think about this topic like a rocket launching into space. There is a main payload which is used to send an email to a sender, the next payload detaches and does its work - in this case the loader Trojan such as FakeHighFive, Subtract This etc load the FakeM virus into memory and execute its functional code.
FakeM Command/Control traffic has evolved quite a bit from sending traffic in the clear to encrypting traffic (which can get detected by Firewalls with SSL decryption and App-id capability) to having a variant of SSL handshake (initial Hello not exchanged) to completely avoid detection. FakeM uses Diffie-Helman key exchange and RC4 algorithm for encryption. Once installed, the remote user can easily do anything on the computer (like retrieve files , delete them etc).
To prevent this kind of attack from happening, End-users can install a good Endpoint protection program , Have a good cloud based Malware detection and sandboxing engine to detect Malware and have URL filtering enabled.
Take a look at this link for a more detailed analysis:
http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/
