By Jennifer LeClaire / CIO Today. Updated February 28, 2013.
An online espionage campaign has been exposed. Kaspersky Lab just published a research report that analyzes a series of security incidents that leverage the PDF exploit in Acrobat Reader.
The finding: a new, highly customized malicious program known as MiniDuke is at the heart of the attacks. Kaspersky reports that the MiniDuke backdoor was used to attack multiple government entities and institutions worldwide during the past week.
A number of high-profile targets have already been compromised by the MiniDuke attacks, including government entities in Ukraine, Belgium, Portugal, Romania, the Czech Republic and Ireland. A research institute, two think tanks, and a healthcare provider in the United States were also compromised, along with a prominent research foundation in Hungary.
MiniDuke Attacks 'Old School'
Eugene Kaspersky, founder and CEO of Kaspersky Lab, called it a "very unusual" cyberattack. He remembers this style of malicious programming from the end of the 1990s and the beginning of the 2000s.
"I wonder if these types of malware writers, who have been in hibernation for more than a decade, have suddenly awoken and joined the sophisticated group of threat actors active in the cyberworld," he pondered. "These elite, 'old school' malware writers were extremely effective in the past at creating highly complex viruses, and are now combining these skills with the newly advanced sandbox-evading exploits to target government entities or research institutions in several countries."
According to Kaspersky, the MiniDuke attackers are still active and have created malware as recently as Feb. 20. To compromise victims, the attackers used social engineering techniques, which involved sending malicious PDF documents to their targets. The PDFs were highly relevant -- with well-crafted content that fabricated human rights seminar information and Ukraine's foreign policy and NATO membership plans.
These malicious PDF files were rigged with exploits attacking Adobe Reader versions 9, 10, and 11, bypassing its sandbox, Kaspersky reported, and a toolkit was used to create these exploits and it appears to be the same toolkit that was used in the recent attack reported by FireEye. However, the firm noted, the exploits used in the MiniDuke attacks were for different purposes and had their own customized malware.
Adobe Responds to Incident
"MiniDuke's highly customized backdoor was written in Assembler and is very small in size, being only 20kb," added Kaspersky."The combination of experienced old school malware writers using newly discovered exploits and clever social engineering to compromise high profile targets is extremely dangerous."
When loaded at system boot, Kaspersky reported, the downloader uses a set of mathematical calculations to determine the computer's unique fingerprint, and in turn uses this data to uniquely encrypt its communications later. It is also programmed to avoid analysis by a hard-coded set of tools in certain environments like VMware. If it finds any of these indicators it will run idle in the environment instead of moving to another stage and exposing more of its functionality by decrypting itself further; this indicates the malware writers know exactly what antivirus and IT security professionals are doing in order to analyze and identify malware.
"The incident response process Adobe has put together and refined over the year has served us well, and we continue to evolve as the threats change," said Brad Arkin, senior director of product security at Adobe.
"The Reader and Acrobat patches we put out last week will ensure users are safe from the 'MiniDuke' campaign, so it's important that users update to the latest version if they have not done so already," Arkin told us.