English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

"NetTraveler is Running!" - Red Star APT Attacks Compromise High-Profile Victims

GReAT
Kaspersky Lab Expert
Posted June 04, 14:01  GMT
Tags: Targeted Attacks, Cyber espionage, Vulnerabilities
0.9
 

Over the last few years, we have been monitoring a cyber-espionage campaign that has successfully compromised more than 350 high profile victims in 40 countries. The main tool used by the threat actors during these attacks is NetTraveler, a malicious program used for covert computer surveillance.

The name “NetTraveler” comes from an internal string which is present in early versions of the malware: “NetTraveler Is Running!” This malware is used by APT actors for basic surveillance of their victims. Earliest known samples have a timestamp of 2005, although references exist indicating activity as early as 2004. The largest number of samples we observed were created between 2010 and 2013.


The NetTraveler builder icon

Known targets of NetTraveler (also known as ‘Travnet’ or “Netfile”) include Tibetan/Uyghur activists, oil industry companies, scientific research centers and institutes, universities, private companies, governments and governmental institutions, embassies and military contractors:

 
The NetTraveler victims map

The following map lists the victim profiles by industry:

 
Note: this chart does not include the victims that couldn’t be identified.

Key findings on the NetTraveler attacks:

  • NetTraveler is designed to steal sensitive data as well as log keystrokes, and retrieve file system listings and various Office or PDF documents.
  • The highest number of infections was located in Mongolia, followed by India and Russia. In total,  infections were identified in 40 countries including Kazakhstan, Kyrgyzstan, China, Tajikistan, South Korea, Spain, Germany, the United States, Canada, the United Kingdom, Chile, Morocco, Greece, Belgium, Austria, Ukraine, Lithuania, Belarus, Australia, Hong Kong, Japan, China, Iran, Turkey, Pakistan, Thailand, Qatar, and Jordan.
  • The group has infected victims across multiple industries including government institutions, embassies, oil and gas industry, research institutes, military contractors and activists.
  • Most recently, the NetTraveler group’s main domains of interest for cyber-espionage activities include space exploration, nanotechnology, energy production, nuclear power, lasers, medicine and communications.
  • During our research, we identified six victims that had been infected by both NetTraveler and Red October.
  • Kaspersky Lab’s products detect and neutralize the malicious programs and its variants used by the NetTraveler Toolkit, including Trojan-Spy.Win32.TravNet and Downloader.Win32.NetTraveler. Kaspersky Lab’s products detect the three Microsoft Office exploits used in the spear-phishing attacks, including Exploit.MSWord.CVE-2010-3333, Exploit.Win32.CVE-2012-0158.

Based on collected intelligence, we estimate the group size to about 50 individuals, most of which speak Chinese natively and have working knowledge of the English language.

The NetTraveler Attacks - Part 1 (public):

  • Executive summary
  • Attack analysis
  • C&C infrastructure
  • Statistics
  • Mitigation
  • Conclusions

For more information, read our full paper «TheNetTravelerAttacks, Part 1» [PDF]


1 comments

Giovanni

2013 Jun 06, 17:34
0
 

Looking for additional information (Part 2)

Who do I contact to receive a copy of the Part 2 of the report?

Reply    
If you would like to comment on this article you must first
login


Bookmark and Share
Share

Analysis

Blog