ESET Reveals Targeted Data Stealing Attacks in Pakistan Using Fake PDF and Document Attachments

News provided by

May 16, 2013, 07:00 ET

SAN DIEGO, May 16, 2013 /PRNewswire/ -- ESET, the global leader in proactive digital protection with a 25 year track record of developing award-winning technology, has uncovered and analyzed a targeted campaign that tries to steal sensitive information from different organizations, particularly in Pakistan (with limited spread around the world). During the course of ESET investigations several leads were discovered that indicate the threat has its origin in India and has been going on for at least two years.

(Photo: http://photos.prnewswire.com/prnh/20130516/AQ16044)

(Logo: http://photos.prnewswire.com/prnh/20121109/SF09648LOGO)

This targeted attack used a code signing certificate issued to a seemingly legitimate company to sign malicious binaries and improve their potential to spread. The company was based in New Delhi, India and the certificate was issued in 2011. The malware spread through documents attached to emails.

"We have identified several different documents that followed different themes likely to be enticing to the recipients. One of these is the Indian armed forces. We do not have precise information as to which individuals or organizations were really specifically targeted by these files, but based on our investigations, it is our assumption that people and institutions in Pakistan were targeted," said Jean-Ian Boutin, ESET malware researcher.

For instance, one of the fake PDF files was delivered through a self-extracting archive called "pakistandefencetoindiantopmiltrysecreat.exe", and ESET telemetry data shows that Pakistan is heavily affected by this campaign with 79 percent of detections being in that country.

The first infection vector was utilizing a widely used and abused vulnerability known as CVE-2012-0158. This vulnerability can be exploited by specially crafted Microsoft Office documents and allows arbitrary code execution. The documents were delivered by email, and the malicious code was executed without the attacked computer user even knowing as soon as the document was opened. The other infection vector was via Windows executable files appearing to be Word or PDF documents–again distributed via email. In both cases, to evade suspicion by the victim, fake documents are shown to the user on execution.

The malware was stealing sensitive data from infected PCs and sending it to the attackers' servers. It was using various types of data-stealing techniques, among them a key-logger, taking screenshots and uploading documents to attackers' computer. Interestingly, the information stolen from an infected computer was uploaded to the attacker's server unencrypted.

"The decision not to use encryption is puzzling considering that adding basic encryption would be easy and provide additional stealth to the operation," said Boutin.

Full technical analysis is available on WeLiveSecurity.com - ESET's news platform with the latest information and analysis on cyber threats and useful security tips.

Detection Names

This is a multi-part and multi-vector threat, below are ESET threat names related to this case:

Win32/Agent.NLD worm
Win32/Spy.Agent.NZD Trojan
Win32/Spy.Agent.OBF Trojan
Win32/Spy.Agent.OBV Trojan
Win32/Spy.KeyLogger.NZL Trojan
Win32/Spy.KeyLogger.NZN Trojan
Win32/Spy.VB.NOF Trojan
Win32/Spy.VB.NRP Trojan
Win32/TrojanDownloader.Agent.RNT Trojan
Win32/TrojanDownloader.Agent.RNV Trojan
Win32/TrojanDownloader.Agent.RNW Trojan
Win32/VB.NTC Trojan
Win32/VB.NVM TrojanWin32/VB.NWB Trojan
Win32/VB.QPK Trojan
Win32/VB.QTV Trojan
Win32/VB.QTY Trojan
Win32/Spy.Agent.NVL Trojan
Win32/Spy.Agent.OAZ Trojan

About ESET

ESET® is on the forefront of proactive endpoint protection, delivering trusted security solutions to make the Internet safer. For over 25 years, ESET has helped customers get the most out of their technology by creating a more secure and trusted online experience with antivirus software for consumers and endpoint security solutions for businesses. Award-winning ESET NOD32® Antivirus technology has detected 100% of the WildList Organization "In-the-Wild" malware samples since testing began in 1998. ESET has received over 75 VB100 awards and consistently earns high ratings from AV-Comparatives, Virus Bulletin, AV-TEST and other independent testing organizations. ESET NOD32® Antivirus, ESET Smart Security®, ESET® Endpoint Solutions, ESET® Mobile Security and ESET® Cyber Security (solution for Mac®) are trusted by millions of users and are among the most recommended security solutions in the world. IDC has recognized ESET as a top-five corporate anti-malware provider.

ESET has global headquarters in Bratislava (Slovakia), with operations in San Diego (U.S.), Buenos Aires (Argentina) and Singapore; and offices in Sao Paulo (Brazil) and Prague (Czech Republic). ESET has malware research centers in Bratislava, San Diego, Buenos Aires, Singapore, Prague, Košice (Slovakia), Krakow (Poland), Montreal (Canada), Moscow (Russia) and an extensive partner network for more than 180 countries. For more information, visit www.eset.com/us or call + 1 (619) 876 5400.