APT

Turla APT group adapts KopiLuwak backdoor for use in G20-themed attack

Security experts at Proofpoint have collected evidence that suggests that the Turla APT group is conducting a new espionage campaign. The experts discovered a newly dropper for the KopiLuwak backdoor, KopiLuwak is a JavaScript malware that was spotted early this year while the APT was delivering it to at least one victim leveraging a document containing an official letter from the Qatar Embassy in Cyprus to the Ministry of Foreign Affairs in Cyprus.

The KopiLuwak uses multiple JavaScript layers to avoid detection, the malicious code gain persistence on the targeted machine by creating a registry key. Once infected a system, the malicious code is able executes a series of commands to collect information and exfiltrate data. Stolen data are temporarily stored in a file that is deleted after it’s encrypted and stored in memory.

The KopiLuwak JavaScript malware is controlled through a collection of compromised websites, the IP address of those websites are hardcoded into the malicious code.

The C&C can send arbitrary commands to the infected system using Wscript.shell.run().

Turla is the name of a Russian cyber espionage APT group (also known as Waterbug, Venomous Bear and KRYPTON) that has been active since at least 2007 targeting government organizations and private businesses.

The list of victims is long and includes also the Swiss defense firm RUAG and the US Central Command.

The Turla’s arsenal is composed of sophisticated hacking tools and malware tracked as Turla (Snake and Uroburos rootkit), Epic Turla (Wipbot and Tavdig) and Gloog Turla. In June 2016, researchers from Kaspersky reported that the Turla APT had started using rootkit), Epic Turla (Wipbot and Tavdig) and Gloog Turla. In June 2016, researchers from Kaspersky reported that the Turla APT had started using Icedcoffee, a JavaScript payload delivered via macro-enabled Office documents.

Back to the present, the APT group appears to be actively targeting G20 participants and those interested in its activities including politicians, member nations, and journalists.

“In this case, the dropper is being delivered with a benign and possibly stolen decoy document inviting recipients to a G20 task force meeting on the “Digital Economy”. The Digital Economy event is actually scheduled for October of this year in Hamburg, Germany. ” states Proofpoint. “The dropper first appeared in mid-July, suggesting that this APT activity is potentially ongoing, with Turla actively targeting G20 participants and/or those with interest in the G20, including member nations, journalists, and policymakers.”

Researchers at Proofpoint recently discovered the dropper on a public malware repository, hackers are delivering it to targets via spear phishing emails that use weaponized attachment titled “Save The Date” invitation to the October G20 taskforce meeting.

The invitation is an executable Program Information File (PIG) that appears as a PDF document, it includes a set of instructions for delivering KupiLuwak. When the victim double-clicks on the PDF icon, the PIF opens the decoy document normally while in the background it delivers the backdoor.

Once installed on a system, KupiLuwak allows the attackers to fully control it.

The experts believe the decoy document is a genuine invitation to the G20 task force meeting and was likely stolen.

“As far as we are aware, this document is not publicly available and so may indicate that an entity with access to the invitation was already compromised. Alternatively, the document may have been legitimately obtained from a recipient.” continues ProofPoint.

“Proofpoint researchers ascertain with medium confidence that the document is legitimate and not fabricated.”

The subject of the weaponized documents used by the hackers suggests the Turla APT is gathering information related to G20 event and its participants.

Anyway, we have to consider that the samples analyzed by Proofpoint were obtained from a public malware repository and were not observed in the wild, this means that it is quite impossible to estimate the full scope and impact of the attack.

The high profile of potentially targeted individuals associated with the G20 and early reconnaissance nature of the tools involved bear further watching. We have notified CERT-Bund of this activity.

We will continue to track the activities associated both with this actor and these new tools and update this blog as details emerge.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – Turla APT, cyber espionage)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.