A Trojan is targeting firms in the energy industry, infiltrating systems in a bid to gather information about a company's operations.
The malware, discovered by researchers working at Symantec, found that most of the attacks involved victims in the petroleum, gas and helium industries, especially those based in the United Arab Emirates, which accounted for one in four attacks.
According to a blog post by Christian Tripputi, security response manager at Symantec, Saudi Arabia, Kuwait, and Pakistan each accounted for 10 per cent of the attacks, while firms in the UK and US accounted for five per cent each.
Tripputi said the attacks were detected in the first couple of months this year and the Trojan looks to create a beachhead on energy firms before sending in further malware to gather further information about the victims.
The initial infection vector involves the use of spam emails coming from the moneytrans[.]eu domain, which acts as an open relay Simple Mail Transfer Protocol (SMTP) server, according to Tripputi.
"These emails include a malicious attachment packed with an exploit for the Microsoft Windows Common Controls ActiveX Control Remote Code Execution Vulnerability (CVE-2012-0158)," he said. "This vulnerability has been exploited in many different attack campaigns in the past, such as Red October."
Tripputi added that the stolen data "enables the attacker to make crucial decisions about how to proceed further with the attack, or to halt the attack".
If the victim organisation is deemed to be interesting, additional Trojans and backdoors would then be installed.
"The attackers distributed customised copies of Backdoor.Cyberat and Trojan.Zbot which are specifically tailored for the compromised computer's profile," said Tripputi.
He said that threats were downloaded from a few servers operating in the US, UK, and Bulgaria.
The security researcher said the group behind the attack does not seem to be particularly advanced, as they exploited an old vulnerability and used their attack to distribute well-known threats that are available in the underground market.
"However, many people still fail to apply patches for vulnerabilities that are several years old, leaving themselves open to attacks of this kind. From the attacker's perspective, they don't always need to have the latest tools at their disposal to succeed," he said. "All they need is a bit of help from the user and a lapse in security operations through the failure to patch."
-
Manufacturers report millions in losses as downtime wreaks havoc on operationsNews UK manufacturers are losing up to £736 million every week due to downtime, according to new research, with outages lasting for several days on end.
-
Microsoft gives OpenAI restructuring plans the green lightNews The deal removes fundraising constraints and modifies Microsoft's rights to use OpenAI models and products
-
CronRat Magecart malware uses 31st February date to remain undetectedNews The malware allows for server-side payment skimming that bypasses browser security
-
Mekotio trojan continues to spread despite its operators’ arrestsNews Hackers have used it in 100 more attacks since arrests
-
“Trojan Source” hides flaws in source code from humansNews Organizations urged to take action to combat the new threat that could result in SolarWinds-style attacks
-
What is Emotet?In-depth A deep dive into one of the most infamous and prolific strains of malware
-
Fake AnyDesk Google ads deliver malwareNews Malware pushed through Google search results
-
Hackers use open source Microsoft dev platform to deliver trojansNews Microsoft's Build Engine is being used to deploy Remcos password-stealing malware
-
Android users told to be on high alert after Cerberus banking Trojan leaks to the dark webNews The source code for the authenticator-breaking malware is available for free on underground forums
-
Qbot malware surges into the top-ten most common business threats
News An evolved form of the banking Trojan was distributed by number one-ranking Emotet in a campaign that hit 5% of businesses globally
