Rurktar Malware: An Espionage Tool in Development

itman · Jul 27, 2017

A newly discovered spyware family that appears designed for cyber-espionage is still under development, G DATA security researchers say.

Dubbed Rurktar, the tool hasn’t had all of its functionality implemented yet, but G DATA says “it is relatively safe to say [it] is intended for use in targeted spying operations.” The malicious program could be used for reconnaissance operations, as well as to spy on infected computers users, and steal or upload files.

The spyware, researchers say, appears to originate from Russia. Some of its internal error messages are written in Russian and the IP addresses used to remotely control the tool are located in the country, which the security firm considers strong indicators of its origin.

At the moment, Rurktar packs functions that allow it to perform reconnaissance of a network infrastructure and check whether a particular machine is reachable or not, as well as to take screenshots of an infected machine’s desktop, and also download specific files from a target system. Furthermore, the program can delete files from the target machine and can also upload files to it.

“All of this points to industrial espionage - the functions that have been described so far do not have any practical application for large-scale operations, such as ransomware schemes,” G DATA explains.
Click to expand...

http://www.securityweek.com/rurktar-malware-espionage-tool-development

Additional detailed analysis: https://file.gdatasoftware.com/web/en/documents/whitepaper/Rurktar.pdf

Log in or Sign up

Rurktar Malware: An Espionage Tool in Development

itman Registered Member

Log in or Sign up

Rurktar Malware: An Espionage Tool in Development

itman Registered Member

Useful Searches