Cyber-Espionage Malware Is So Advanced It Has Its Own API

itman · May 5, 2017

Russian cyberspies have developed a new breed of backdoor trojan that features several novel techniques, including an API that allows attackers to reverse the C&C communications flow when needed.

This new threat came to light on Wednesday via two reports from Fox-IT and Palo Alto Networks, respectively.

In the malware's source code, its author referenced this tool as Kazuar, a word that means "cassowary" in several Slavic languages.

Researchers say Kazuar is coded in the .NET Framework and appears to have versions for all three major operating systems. The Palo Alto report analyzes Kazuar, the name given to the Windows version, while the Fox-IT report analyzes Snake, the name given to the Mac version. A Linux version has not been seen yet, but Palo Alto says there are clues in the Kazuar source code that hint at its existence.

Kazuar linked to the Turla APT

Both Fox-IT and Palo Alto have linked this backdoor to a cyber-espionage group called Turla, believed to be operating out of Russia, and who Kaspersky believes is linked to one of the first cyber-espionage groups ever spotted, the Moonlight Maze APT that was active as early as 1995, well over two decades ago.
Click to expand...

https://www.bleepingcomputer.com/ne...ge-malware-is-so-advanced-it-has-its-own-api/

itman · May 5, 2017

Of note is Cloudstrike Falcon detected this malware w/90+% confidence way back on 1/30/2017 per VT hash analysis results; way before anyone else did. If I was a corp. IT security person, I would be taking a "hard look" at Cloudstrike. It's looking better and better.

Log in or Sign up

Cyber-Espionage Malware Is So Advanced It Has Its Own API

itman Registered Member

itman Registered Member

Log in or Sign up

Cyber-Espionage Malware Is So Advanced It Has Its Own API

itman Registered Member

itman Registered Member

Useful Searches