Energy companies targeted by Laziok Trojan

Malware enters infrastructure, then sends in more advanced viruses to carry out attacks

Hacker

A Trojan is targeting firms in the energy industry, infiltrating systems in a bid to gather information about a company's operations.

The malware, discovered by researchers working at Symantec, found that most of the attacks involved victims in the petroleum, gas and helium industries, especially those based in the United Arab Emirates, which accounted for one in four attacks.

According to a blog post by Christian Tripputi, security response manager at Symantec, Saudi Arabia, Kuwait, and Pakistan each accounted for 10 per cent of the attacks, while firms in the UK and US accounted for five per cent each.

Tripputi said the attacks were detected in the first couple of months this year and the Trojan looks to create a beachhead on energy firms before sending in further malware to gather further information about the victims.

The initial infection vector involves the use of spam emails coming from the moneytrans[.]eu domain, which acts as an open relay Simple Mail Transfer Protocol (SMTP) server, according to Tripputi.

"These emails include a malicious attachment packed with an exploit for the Microsoft Windows Common Controls ActiveX Control Remote Code Execution Vulnerability (CVE-2012-0158)," he said. "This vulnerability has been exploited in many different attack campaigns in the past, such as Red October."

Tripputi added that the stolen data "enables the attacker to make crucial decisions about how to proceed further with the attack, or to halt the attack".

If the victim organisation is deemed to be interesting, additional Trojans and backdoors would then be installed.

"The attackers distributed customised copies of Backdoor.Cyberat and Trojan.Zbot which are specifically tailored for the compromised computer's profile," said Tripputi.

He said that threats were downloaded from a few servers operating in the US, UK, and Bulgaria.

The security researcher said the group behind the attack does not seem to be particularly advanced, as they exploited an old vulnerability and used their attack to distribute well-known threats that are available in the underground market.

"However, many people still fail to apply patches for vulnerabilities that are several years old, leaving themselves open to attacks of this kind. From the attacker's perspective, they don't always need to have the latest tools at their disposal to succeed," he said. "All they need is a bit of help from the user and a lapse in security operations through the failure to patch."

Featured Resources

Five lessons learned from the pivot to a distributed workforce

Delivering continuity and scale with a remote work strategy

Download now

Connected experiences in a digital transformation

Enable businesses to meet the demands of the future

Download now

Simplify to secure

Reduce complexity by integrating your security ecosystem

Download now

Enhance the safety and security of your people, assets and operations

Enable a true vision of security with an engineered solution based on hyperconverged and storage platforms

Download now

Recommended

What is a Trojan?
Security

What is a Trojan?

15 Jun 2020
'Largest ever' Magecart hack compromises 2,000 online stores
hacking

'Largest ever' Magecart hack compromises 2,000 online stores

15 Sep 2020
'NetWalker' ransomware explodes thanks to 'as a service' expansion
ransomware

'NetWalker' ransomware explodes thanks to 'as a service' expansion

4 Sep 2020
Infocyte integrates with Palo Alto Networks Cortex XSOAR
cyber security

Infocyte integrates with Palo Alto Networks Cortex XSOAR

19 Aug 2020

Most Popular

Accenture ploughs $3 billion into cloud migration support group
digital transformation

Accenture ploughs $3 billion into cloud migration support group

17 Sep 2020
Google Pixel 4a review: A picture-perfect package
Google Android

Google Pixel 4a review: A picture-perfect package

18 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020