An ongoing cyberespionage campaign compromised over 350 high-profile victims from more than 40 countries over the past eight years, including political activists, research centers, governmental institutions, embassies, military contractors and private companies from various industries.
Researchers from antivirus vendor Kaspersky Lab named the campaign NetTraveler, after a string found in the main data stealing malware associated with the attacks.
The largest number of NetTraveler malware samples was created between 2010 and 2013, but the earliest samples identified have time stamps from 2005 and there's some evidence that the malware has been active since 2004, the Kaspersky researchers said Tuesday in a blog post.
NetTraveler, also known as Travnet, is designed to steal documents, primarily DOC, XLS, PPT, RTF and PDF, and to perform basic computer surveillance. However, some configurations target extended lists of files, including those with extensions like CDR, which are associated with Corel Draw, or DWG, DXF, CDW and DWF, which correspond to AutoCAD projects.
In addition to the NetTraveler malware, the attackers behind this campaign also used other backdoor-type malware including Saker, also known as Xbox, and PCRat, also known as Zegost.
The primary attack method consists of spear-phishing emails carrying malicious documents that exploit two remote code execution vulnerabilities that affect Microsoft Office, namely CVE-2012-0158 and CVE-2010-3333, in order to install the malware.
These vulnerabilities were fixed by Microsoft in 2012 and 2010 respectively, but they are still effective against targets that haven't deployed the patches and are commonly exploited to infect computers in targeted attacks, the Kaspersky researchers said in a report about the cyberespionage campaign released Tuesday.
There is no evidence that the NetTraveler attackers used advanced techniques like the exploitation of zero-day — previously unknown — vulnerabilities or sophisticated malware like rootkits, the researchers said. "It is therefore surprising to observe that such unsophisticated attacks can still be successful with high profile targets."
Based on an analysis of infection logs from several of the command and control (C&C) servers associated with this campaign that show activity going back to 2009, the Kaspersky researchers identified over 350 victims. However, considering that there are other C&C servers from where logs have not been obtained, the total number of victims is estimated to be around 1,000, they said.
"We have calculated the amount of stolen data stored on C&C servers to be 22+ gigabytes," the researchers said. "However this data represents only a small fraction which we managed to see — the rest of it had been previously downloaded and deleted from the C&C servers by the attackers."
Detection statistics for NetTraveler samples collected from Kaspersky's network showed that the country with the highest number of infections is Mongolia, followed by Russia, India and Kazakhstan. The U.S. is not in the top 10.
Sign up for CIO Asia eNewsletters.