Trend Micro Facebook TrendLabs Twitter Malware Blog RSS Feed You Tube - Trend Micro
Search our blog:

  • Mobile Vulnerabilities

  • Zero-Day Alerts

  • Recent Posts

  • Calendar

    July 2013
    S M T W T F S
    « Jun   Aug »
  • Email Subscription

  • About Us

    Archive for July 15th, 2013

    Over the last number of years there has been a noticeable rise in the number of reported targeted attacks, which are also commonly referred to as advanced persistent threats (APTs). Notable examples of said attacks include the Red October campaign or the IXESHE APT.

    What sets a targeted attack apart from a widespread attack is purely the motivation behind the attackers and their victims. The actual tools used are largely irrelevant; the tools are identical, but the motivations of the attackers and the targeted victims set a targeted attack apart. For example, a Remote Access Tool (RAT) that infects users across 50 countries would be considered a widespread attack – while the same attack against two nuclear power plants against no one else is an example of a targeted attack. The tool is identical but the motivation of the attackers and their chosen targets set the attacks apart.

    One thing that clear about targeted attacks is that they are difficult to detect, and not much research has been conducted so far in detecting these attacks.

    Our paper discusses a new system we’ve called SPuNge that processes threat information gathered via feedback provided by the Smart Protection Network to detect potential targeted attacks for further investigation.

    We use a combination of clustering and correlation techniques to identify groups of machines that share a similar behavior with the respect to the malicious resources they access and the industry in which they operate (e.g. oil & gas).

    The techniques we adopt include a text-based hierarchical clustering aimed at finding clusters of similar malicious URLs, i.e. having common patterns in hostnames, paths or query strings. We correlate them with information on the users machine, such as their IP address, to identify groups of customers affected by the same threat. Finally, we automatically correlate these groups with both the industry and the geographical information to discover potential targeted attacks.

    We used SPuNge to examine existing feedback from more than 20 million Trend Micro customers to see if the system was effective and useful in identifying threats. The tests were able to show that SPuNge is a powerful and useful tool in assisting cybercrime investigation.

    The methodology of SPuNge is described in the paper Targeted Attacks Detection with SPuNge. In addition, we discussed this topic at PST2013, the eleventh International Conference on Privacy, Security and Trust which was recently held in Tarragona, Catalonia.


    Trend Micro researchers have uncovered a targeted attack launched against government agencies in various countries. The email claimed to be from the Chinese Ministry of National Defense, although it appears to have been sent from a Gmail account and did not use a Chinese name.

    Figure 1. Fake message

    The document contains a malicious attachment, which exploits a vulnerability (CVE-2012-0158) in Microsoft Office (all versions from Office 2003 to Office 2010 were affected) that was patched more than a year ago. The exploit is used to drop a backdoor onto the system, which steals login credentials for websites and email accounts from Internet Explorer and Microsoft Outlook. (It also opens a legitimate “dummy” document, to make the target believe that nothing malicious happened.) Any stolen information is uploaded to two IP addresses, both of which are located in Hong Kong.

    This particular attack was aimed primarily at both personnel belonging to Europe and Asia governments. The message was sent to 16 officials representing European countries alone. The topic of the email – and the attached document – would be of interest to these targets. In addition, the information stolen and where it was stolen from – is very consistent with targeted attacks aimed at large organizations that use corporate mainstays like Internet Explorer and Outlook.

    It’s worth noting, however, that Chinese media organizations were also targeted by this attack. The backdoor itself has also been detected in the wild – but, interestingly, it has been most frequently seen in China and Taiwan, with a more limited presence in other Asian countries.

    The vulnerability used in this attack is one that is commonly used by targeted attacks. High-profile campaigns like Safe and Taidoor have made use of this vulnerability; if anything it’s a commonly targeted flaw in sophisticated campaigns.

    Trend Micro products already detect all aspects of this threat – the message and C&C servers are now blocked; the malicious attachment is detected as TROJ_DROPPER.IK and the backdoor itself as BKDR_HGDER.IK. In addition, Deep Discovery was able to protect our customers by heuristically detecting the malicious attachment using the ATSE (Advanced Threats Scan Engine).

    Based on analysis by Jayronn Bucu.


    An unusual attack has been spotted in the wild, using an unexpected combination of threats. This attack used exploit kits (in particular Java and PDF exploits) to deliver file infectors onto vulnerable systems. Interestingly, these file infectors have information theft routines, which is a behavior not usually found among file infectors. These malware are part of PE_EXPIRO family, file infectors that was first spotted spotted in 2010. In addition to standard file infection routines, the variants seen in this attack also have information theft routines, an uncommon routine for file infectors. The infection chain goes something like this:

    • The user is lured to a malicious site which contains an exploit kit. Several exploits are used; one of these is a Java exploit (detected as JAVA_EXPLOIT.ZC) which uses CVE-2012-1723. Another Java vulnerability (CVE-2013-1493) is also being used. A PDF exploit is also being used, with the malicious PDF file detected as TROJ_PIDIEF.JXM.
    • Whatever exploit is used, the end result is the same: the mother file infector (either PE_EXPIRO.JX-O, PE_EXPIRO.QW-O, or PE64-EXPIRO-O for 64-bit systems) onto the affected system.
    • Once on the affected system, it seeks out .EXE files in the system to infect. All folders in all available drives (removable, shared, networked) are subjected to this search. The infected files are detected as PE_EXPIRO.JX.
    • It steals system and user information, such as the Windows product ID, drive volume serial number, Windows version and user login credentials. It also steals stored FTP credentials from the Filezilla FTP client.
    • The stolen information is then saved in a .DLL file and uploaded to various command-and-control (C&C) servers.

    Here is a diagram of the above chain, using the Java exploit as an example:

    About 70% of total infections are within the United States. It is possible that this attack was intended to steal information from organizations or to compromise websites, as the specific targeting of FTP credentials suggests either was possible. The combination of threats used is highly unusual and suggests that this attack was not an off-the-shelf attack that used readily available cybercrime tools.

    Since this particular attack used exploits targeting vulnerabilities, we recommend users to update their systems with the latest security patches immediately. Trend Micro blocks the websites associated with this attack, as well as detecting the malware cited in this blog entry.

    Additional Analysis by Dexter To, Kai Yu, and Jethro Bacani



    © Copyright 2013 Trend Micro Inc. All rights reserved. Legal Notice