MiniDuke Spyware Dates Back to 2011

Tuesday, March 5, 2013 @ 04:03 PM gHale


Falling into the category of advanced persistent threat, MiniDuke, the spyware mainly aimed at governments and their agencies in Europe, has been operating for at least 21 months.

A sample of the software, discovered by researchers at Romanian antivirus firm Bitdefender, dates back to June 20, 2011. Later variants of the spying tool connect to a U.S. Navy server to fetch the latest time and date rather than looking up the current date in China from a neutral server.

RELATED STORIES
‘MiniDuke’ Attack from Nation State
Trojan Hits Governments
Hiding Code into JavaScript
Trojan a Work of ‘Poetry’

The 2011 vintage MiniDuke sample pulls the location of its command-and-control systems from an active Twitter account — a single encoded URL tweeted on February 21, 2012 — and lays dormant on infected computers if it can’t connect to Twitter. The Microsoft Windows malware, essentially an executable embedded in a .dll file, installs itself on the infected computer and opens a backdoor allowing intruders to control and snoop on the PC.

Later variants search Google as a backup technique to discover the whereabouts of its masters’ command-and-control servers; this functionality is absent in the 2011 sample. All builds of the malware use encrypted channels to communicate between compromised machines and the central command systems, which experts assume are hacked servers.

The latest 2013 variants of the malware are notable for using malicious PDF files that exploit software security holes by successfully bypassing Adobe’s sandbox technology, which should stop code within documents from harming the underlying system.

Catalin Cosoi, chief security strategist at Bitdefender, said that all versions discovered so far show MiniDuke’s mission was to spy on government targets.

“MiniDuke was clearly designed as a cyber-espionage tool to specifically target key sensitive government data,” he said.

MiniDuke has infected government organizations in the Ukraine, Belgium, Portugal, Romania, the Czech Republic and Ireland. In addition, a research institute, two think-tanks, and a healthcare provider in the U.S. also suffered compromise.

Romania’s intelligence service SRI described MiniDuke as a state-sponsored weapon that had an even bigger impact than the earlier Red October attack, a computer espionage mission that targeted Eastern Europe and former Soviet countries.

Both Red October and MiniDuke operated for many months before they were detected by antivirus vendors, a delay that is all too common when “advanced persistent threat” teams deploy malware.



Leave a Reply

You must be logged in to post a comment.