StealthFalcon malware spread through the Windows update mechanism

By using the Windows update delivery system, the malicious traffic of this trojan can evade firewalls

Trojan

Windows Background Intelligent Transfer Service (BITS) is being exploited again, with a malware strain is using it to spread between computers.

Windows BITS is the default mechanism the operating system (OS) uses to send Windows updates to systems all over the world, and attackers are now using it to hide traffic to and from their command and control (C&C) server, sent by the backdoor.

Slovakian cyber security outfit ESET discovered the trojan and named it Win32/StealthFalcon, eponymic of the group to which it's attributed.

The StealthFalcon group has been around since 2012, according to the limited reports there are on the organisation, and is believed to be a state-sponsored group which originally targeted United Arab Emirates (UAE) dissidents.

Instead of sending HTTP or HTTPS traffic back to the C&C server, the trojan masks this traffic by routing it through BITS, a method the researchers believe will more easily evade firewalls.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

This is because BITS isn't just used for Windows updates, other programs use it to distribute their own updates and even Mozilla is working on pushing Firefox's improvements through BITS.

Because BITS is known by firewalls to carry traffic from legitimate sources, such as necessary updates, it often doesn't search it when scanning for cyber threats, making it a perfect fit to carry malicious code.

The researchers said the method of the trojan's delivery was "beyond the scope of this investigation" but targets have been observed in UAE Saudi Arabia, Thailand and the Netherlands.

Links have been made between StealthFalcon and Project Raven, two groups previously thought to be independent of one another, after pieces from reports such as their file naming structure were found to be too similar to be different parties.

Amnesty International's Senior Technologist, Claudio Guarnieri, has concluded that Stealth Falcon and Project Raven actually are the same group.

Advertisement - Article continues below

Details of Project Raven were unearthed in a January Reuters investigation which allegedly found evidence that former NSA experts were helping UAE authorities track and hack dissidents, journalists and human rights activists.

Although leveraging BITS to hide malicious traffic is an unusual method, it has certainly been done before. Chinese state-sponsored hacking groups Periscope and Tropic Trooper are both believed to have launched similar attacks.

Featured Resources

Digitally perfecting the supply chain

How new technologies are being leveraged to transform the manufacturing supply chain

Download now

Three keys to maximise application migration and modernisation success

Harness the benefits that modernised applications can offer

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

The 3 approaches of Breach and Attack Simulation technologies

A guide to the nuances of BAS, helping you stay one step ahead of cyber criminals

Download now
Advertisement

Recommended

Visit/security/30081/what-is-a-trojan-virus
Security

What is a Trojan?

14 Aug 2019
Visit/malware/33080/hackers-abuse-linkedin-dms-to-plant-malware
malware

Hackers abuse LinkedIn DMs to plant malware

25 Feb 2019
Visit/security/malware/28083/the-five-best-free-malware-removal-tools
Security

Best free malware removal tools 2019

23 Dec 2019
Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019

Most Popular

Visit/microsoft-windows/32066/what-to-do-if-youre-still-running-windows-7
Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
Visit/operating-systems/25802/17-windows-10-problems-and-how-to-fix-them
operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020
Visit/operating-systems/microsoft-windows/354526/memes-and-viking-funerals-the-internet-reacts-to-the
Microsoft Windows

Memes and Viking funerals: The internet reacts to the death of Windows 7

14 Jan 2020
Visit/hardware/laptops/354533/dell-xps-13-new-9300-hands-on-review-chasing-perfection
Laptops

Dell XPS 13 (New 9300) hands-on review: Chasing perfection

14 Jan 2020