TajMahal cyber-espionage campaign uses previously unseen malicious tools

guest · Apr 10, 2019

TajMahal cyber-espionage campaign uses previously unseen malicious tools
April 10, 2019
https://www.zdnet.com/article/tajma...paign-uses-previously-unseen-malicious-tools/

A newly discovered form of malware deployed as part of a highly stealthy cyber-espionage campaign comes with several new malicious functionalities. It appears to be the work of a completely new operation, with no known links to any known threat actors or hacking groups.

Dubbed TajMahal, after the file it uses to exfiltrate stolen data, the malware has a number of capabilities not previously seen in a backdoor.
These include stealing documents sent to the printer queue, the ability to steal files previously seen on removable drives as soon as they're available again, the ability to steal data burnt onto a CD by the victim, as well as the ability to take screenshots when recording audio from VoiceIP applications.

The malware has been uncovered by researchers at Kaspersky Lab, who have detailed their finding's at the company's Security Analyst Summit 2019 in Singapore.
Click to expand...

"The file turned out to be a malicious plugin of a level of sophistication that suggested an APT - and the lack of code similarity to any known attack suggested it was a previously unknown APT," Alexey Shulmin, lead malware analyst at Kaspersky Lab told ZDNet.

"Using our knowledge of this file, we were able to identify more of them. That led us to the conclusion that the malware was part of a previously unknown, extremely rare, cyber-espionage platform," he added.
Click to expand...

guest · Apr 10, 2019

Mysterious Hackers Hid Their Swiss Army Spyware for 5 Years
April 9, 2019
https://www.wired.com/story/tajmahal-swiss-army-spyware-apt/

"It seems highly unlikely that such a huge investment would be undertaken for only one victim," he writes. "This suggests that there are either further victims not yet identified, or additional versions of this malware in the wild, or possibly both."

Those initial findings may indicate a very cautious and discreet state-sponsored intelligence-gathering operation, says Jake Williams, a former member of the National Security Agency's elite Tailored Access Operations hacking group.
Considering its sophistication and eclectic features, it's remarkable how long TajMahal remained undetected.
Some modules dated back to 2013, while others dated as recently as 2018.

"Somehow, it has stayed under the radar for over five years. Whether this is due to relative inactivity or something else is another intriguing question," Shulmin writes. "It is a reminder to the cybersecurity community that we never really have full visibility of everything that is going on in cyberspace."
Click to expand...

Log in or Sign up

TajMahal cyber-espionage campaign uses previously unseen malicious tools

guest Guest

guest Guest

Log in or Sign up

TajMahal cyber-espionage campaign uses previously unseen malicious tools

guest Guest

guest Guest

Useful Searches