New TeleBots backdoor: First evidence linking Industroyer to NotPetya

guest · Oct 11, 2018

New TeleBots backdoor: First evidence linking Industroyer to NotPetya
October 11, 2018
https://www.welivesecurity.com/2018/10/11/new-telebots-backdoor-linking-industroyer-notpetya/

[...] Conclusion
The discovery of Exaramel shows that the TeleBots group is still active in 2018 and the attackers keep improving their tools and tactics.

The strong code similarity between the Win32/Exaramel backdoor and the Industroyer main backdoor is the first publicly presented evidence linking Industroyer to TeleBots, and hence to NotPetya and BlackEnergy. While the possibility of false flags – or a coincidental code sharing by another threat actor – should always be kept in mind when attempting attribution, in this case we consider it unlikely.

Of particular interest is the fact that the attackers started to use ESET-themed domain names in their operations.
Click to expand...

itman · Oct 11, 2018

Of note:

Another interesting fact is that the backdoor uses C&C servers with domain names that mimic domains belonging to ESET. In addition to esetsmart[.]org from the above mentioned configuration, we found another similar domain: um10eset[.]net, which was used by recently-discovered Linux version of Telebots malware. It is important to note that these attacker-controlled servers are in no way related to ESET’s legitimate server infrastructure. Currently, we haven’t seen Exaramel use domains that mimic other security companies.
Click to expand...

Log in or Sign up

New TeleBots backdoor: First evidence linking Industroyer to NotPetya

guest Guest

itman Registered Member

Log in or Sign up

New TeleBots backdoor: First evidence linking Industroyer to NotPetya

guest Guest

itman Registered Member

Useful Searches