APT group leverage Gazer backdoor to spy on embassies and consular operations

Security researchers at ESET have spotted a new cyber espionage campaign targeting embassies, consulates, and ministries worldwide.

Hackers leverage a new backdoor dubbed Gazer to spy on governments and diplomats.
The campaign active at least since 2016 was associated infamous Russian Turla APT group.

“Security researchers at ESET have released new research today into the activities of the notorious Turla cyberespionage group, and specifically a previously undocumented backdoor that has been used to spy on consulates and embassies worldwide.” reads the analysis published by ESET.

“ESET’s research team are the first in the world to document the advanced backdoor malware, which they have named “Gazer”, despite evidence that it has been actively deployed in targeted attacks against governments and diplomats since at least 2016.”

The Skipper backdoor was used by the Turla APT group in previous campaigns. While in previous campaigns, the Turla APT group leveraged Carbon and Kazuar backdoors during the second-stage of the attack, recently the group opted for the Gazer backdoor.

“The second-stage backdoor receives encrypted instructions from the gang via C&C servers, using compromised, legitimate websites as a proxy.” continues the analysis.

To remain stealthy and evade detection, the threat actor leveraged compromised, legitimate websites as a proxy, most of them running WordPress CMS.

“The list of C&C servers is encrypted and embedded in Gazer’s PE resources. They are all compromised, legitimate websites (that mostly use the WordPress CMS) that act as a first layer proxy. This is also a common tactic for the Turla APT group.
Another interesting linkage is that one of the C&C servers embedded in a Gazer sample was known to be used in a JScript backdoor documented by Kaspersky as Kopiluwak” reads the research paper published by ESET.

Gazer’s authors heavily leverage on encryption, they are using a custom library for 3DES and RSA instead of the Windows Crypto API.
“The RSA keys embedded in the resources contains the attacker’s public key which is used to encrypt the data sent to the C&C server, and a private key to decrypt resources embedded in its binaries. These keys are unique in each sample.” reads the analysis.

The Gazer backdoor leverages code-injection technique to take control of a machine and to remain hidden for a long period of time while exfiltrating information from the targeted machine.