Pierluigi Paganini
August 31, 2017
“From February to September 2016, WhiteBear activity was narrowly focused on embassies and consular operations around the world. All of these early WhiteBear targets were related to embassies and diplomatic/foreign affair organizations.”
The Gazer backdoor was written in C++, hackers deliver the malicious code via spear phishing emails and compromise the targeted computers in two stages.
In the first stage, the malware drops another backdoor dubbed Skipperbackdoor, then installs the Gazer malicious code.
“Security researchers at ESET have released new research today into the activities of the notorious Turla cyberespionage group, and specifically a previously undocumented backdoor that has been used to spy on consulates and embassies worldwide.” reads the analysis published by ESET.
“ESET’s research team are the first in the world to document the advanced backdoor malware, which they have named “Gazer”, despite evidence that it has been actively deployed in targeted attacks against governments and diplomats since at least 2016.”
The Skipper backdoor was used by the Turla APT group in previous campaigns. While in previous campaigns, the Turla APT group leveraged Carbon and Kazuar backdoors during the second-stage of the attack, recently the group opted for the Gazer backdoor.
“The second-stage backdoor receives encrypted instructions from the gang via C&C servers, using compromised, legitimate websites as a proxy.” continues the analysis.
To remain stealthy and evade detection, the threat actor leveraged compromised, legitimate websites as a proxy, most of them running WordPress CMS.
“The list of C&C servers is encrypted and embedded in Gazer’s PE resources. They are all compromised, legitimate websites (that mostly use the WordPress CMS) that act as a first layer proxy. This is also a common tactic for the Turla APT group.
Another interesting linkage is that one of the C&C servers embedded in a Gazer sample was known to be used in a JScript backdoor documented by Kaspersky as Kopiluwak” reads the research paper published by ESET.
Gazer’s authors heavily leverage on encryption, they are using a custom library for 3DES and RSA instead of the Windows Crypto API.
“The RSA keys embedded in the resources contains the attacker’s public key which is used to encrypt the data sent to the C&C server, and a private key to decrypt resources embedded in its binaries. These keys are unique in each sample.” reads the analysis.
The Gazer backdoor leverages code-injection technique to take control of a machine and to remain hidden for a long period of time while exfiltrating information from the targeted machine.
ESET malware researchers have identified four different variants of the Gazer backdoor in the wild. Earlier versions of Gazer were signed with a valid certificate issued by Comodo for “Solid Loop Ltd,” while the latest version is signed with an SSL certificate issued to “Ultimate Computer Support Ltd.”
Earlier versions of the backdoor were signed with a valid certificate issued by Comodo for “Solid Loop Ltd,” while the latest version is signed with a certificate issued to “Ultimate Computer Support Ltd.”
The backdoor was involved in cyber espionage operations against targets in Southeast European and former Soviet bloc.
According to researchers, Gazer has already managed to infect a number of targets worldwide, with the most victims being located in Europe.
