Targeted Attack: Device Maker Hit

Wednesday, September 3, 2014 @ 01:09 PM gHale

A variant of the Bifrose backdoor was part of an attack focused on a device manufacturer.

The threat, detected by Trend Micro as BKDR_BIFROSE.ZTBG-A, is more evasive than previous variants because it uses the Tor anonymity network for command and control (C&C) communications.

Exploit Kit Remains Adaptive
Exploit Kit Delivers Double Payload
Attack on Tor to Deanonymize Users
Malware Down, but Infrastructure Remains

After infecting a device, the backdoor allows its masters to perform various tasks, including downloading and uploading files, creating and deleting folders, executing files and commands, capturing keystrokes, capturing screenshots and webcam images, terminating processes, collecting system information and manipulating windows.

“BIFROSE is mostly known for its keylogging routines, but it is capable of stealing far more information than just keystrokes,” said Trend Micro threat response engineer Christopher Daniel So explained in a blog post. “It can also send keystrokes and mouse events to windows, which means that the attacker may be able to conduct operations as the affected user without having to compromise their accounts. For example, the attacker can log into internal systems or even send messages to other users in the network.”

While C&C communications via Tor can make the threat more elusive, the same communications can also end up used by IT administrators to detect an attack. More precisely, they can identify malicious activity by monitoring the network for Tor traffic. Many organizations don’t use Tor for regular operations so any traffic associated with the anonymity network could indicate some type of cyberattack.

Another method recommended by Trend Micro for detecting Bifrose, in addition to the use of security solutions, involves checking for a file named klog.dat, used for the threat’s keylogging routines. Verifying network and mail logs could also help IT administrators in detecting the malware.

The BIFROSE variant used against the device manufacturer, which the company kept anonymous, is able to do the following information stealing routines:
• Download a file
• Upload a file
• Get file details (file size, last modified time)
• Create a folder
• Delete a folder
• Open a file using ShellExecute
• Execute a command line
• Rename a file
• Enumerate all windows and their process IDs
• Close a window
• Move a window to the foreground
• Hide a window
• Send keystrokes to a window
• Send mouse events to a window
• Terminate a process
• Get display resolution
• Upload contents of %Windows%\winieupdates\klog.dat
• Capture screenshot or webcam image

Leave a Reply

You must be logged in to post a comment.