Bachosens trojan: Lone wolf after big game, Symantec report

itman · May 31, 2017

A lone-wolf hacker is going after big game, albeit to little reward, according to a post on Symantec's Security Response blog.

While the Symantec Security Response researchers who analyzed the attack campaign concluded that the hacker was highly sophisticated – his code bears similarities to malware put in play by nation-state actors – and his tragets were significant in scale, he only eked out a meager living from his criminal exploits and, ultimately, lacked the expertise to avoid detection.

The lone wolf attacker, dubbed Igor, was seen deploying advanced malware in highly targeted cyberattacks against specific large enterprises, the Symantec researchers wrote.

The malware tool Igor crafted, Trojan.Bachosens, opened backdoors on compromised computers and siphoned out information. It also is capable of downloading potentially malicious files.

His exploits afforded him access to at least two large enterprises, an international airline and a Chinese auto-tech company. Similar to strategies used by nation-state actors, he used spear-phishing emails, Symantec believed, to load his malware onto the systems.

In the case of the auto firm, Igor stole car diagnostic software, which he was observed selling on underground forums and his own site for a highly discounted price. This activity might be traced back as far as 2009, although Symantec initially detected the use of Bacherons in 2014. After the Symantec researchers confirmed links between the domains revealed in Igor's postings – including sightings of unauthorized sales, variants of keyloggers, evidence of Bachosens, phishing emails containing Bachosens and malware infections – they concluded that the malware author has been active for at least 10 years.

Traces of the trojan were also spotted on the system of a large commercial airline and in an online gambling operation. In these cases, however, the researchers could not discern to what end, although they are certain it was planted by Igor.

While the researchers hypothesize that the sophisticated malware may have simply been purchased, rather than developed by Igor, ultimately, they said, because no other bad actor has been observed using this malware, the conclusion must be that Igor, in fact, did craft it himself.

What distinguishes Igor's technique is the use of "rarely used" covert communication channels, such as DNS, ICMP and HTTP to link with a command-and-control server, Symantec wrote. He also encrypts data siphoned from his victims as its sent to the C&C server, "with the malware programmed to create a set of ephemeral AES keys to encrypt the data before sending it."

He further obfuscates his action by transmitting via IPv6, tougher to detect than if sent via IPv4.

However, Igor messed up and drew the attention of investigators after he submitted some of his malware samples to a tester. He also left traces of his identity by posting personal information on a public auto marketplace forum, where he was selling his stolen software using his name.

Symantec investigation into his identity revealed that Igor is likely located in the town of Tiraspol, the second largest city in Moldova. This is disputed territory as the area has also been self-declared as the republic of Transnistria, not yet recognized by the U.N. In any case, the dominant language here is Russian – Russian language strings were detected in Igor's Bachosens malware and size suffixes were indicated with Russian terminology – further evidence that Igor is a Russian speaker, the Symantec team wrote.
Click to expand...

https://www.scmagazine.com/bachosens-trojan-lone-wolf-after-big-game-symantec-report/article/665164/

itman · Jun 1, 2017

Man Linked to Auto Parts Store Behind Bachosens Malware

A man linked to an auto parts store in a disputed territory of Moldova is behind the Bachosens malware, a backdoor trojan used in a very small number of attacks, but one of the most advanced threats of its kind.

For the past seven years, the Bachosens trojan has been linked to only three malware infections. Due to the malware's advanced features and its limited usage, the security company investigating these attacks understandably thought this was the work of a nation-state actor.
Click to expand...

https://www.bleepingcomputer.com/ne...to-auto-parts-store-behind-bachosens-malware/

Log in or Sign up

Bachosens trojan: Lone wolf after big game, Symantec report

itman Registered Member

itman Registered Member

Log in or Sign up

Bachosens trojan: Lone wolf after big game, Symantec report

itman Registered Member

itman Registered Member

Useful Searches