On Wednesday Kaspersky published its report (PDF) on this ongoing hack. According to a post on the SecureList blog, since February 12, the actors behind the malware have taken advantage of an exploit in Adobe’s hugely popular Reader, and used “extremely effective social engineering techniques which involved sending malicious PDF documents to their targets” to spread the infection.
“The PDFs were highly relevant and well-crafted content that fabricated human rights seminar information (ASEM) and Ukraine’s foreign policy and NATO membership plans,” according to the report.
When opened, these PDFs drop a small downloader onto the infected computer. The downloader ascertains the device’s fingerprint, encrypts its communication, and installs a device-specific backdoor.
Then, it searches the Web for “specific tweets from pre-made accounts.” That’s right. The malware makes the infected device search for specific Twitter posts containing links to command and control servers (C2), “which then provide potential commands and encrypted transfers of additional backdoors onto the system via GIF files.”
In other words, MiniDuke is a system that uses Twitter as an infection vector to take over your devices.
The inane and off-sounding tweets that accompany the infected strings include such bon mots as “The weather is good today. Sunny!” and “Albert, my cousin. He is working hard.”
But this malware is so complex that even if Twitter is down, or otherwise uncontactable, it will use Google search to find the encrypted strings that lead to the C2.
The backdoors are “obfuscated within GIF files and disguised as pictures that appear on a victim’s machine.” Once these backdoors are downloaded, “they can fetch a larger backdoor which carries out the cyberespionage activities, through functions such as copy file, move file, remove file, make directory, kill process and of course, download and execute new malware and lateral movement tools.”
Kaspersky and CrySys have identified 59 victims of MiniDuke in 23 countries: Belgium, Brazil, Bulgaria, the Czech Republic, Georgia, Germany, Hungary, Ireland, Israel, Japan, Latvia, Lebanon, Lithuania, Montenegro, Portugal, Romania, the Russian Federation, Slovenia, Spain, Turkey, Ukraine, the United Kingdom and the United States.
The malware received its name due to its similarity to another called “Duqu” and due to the presence of quotations from Dante’s “The Divine Comedy” in its shellcode.
The CrySyS Lab analysis of MiniDuke has more technical details about the attack.
Image via CrySys Lab
Homeless man plays best cover of Styx's 'Come Sail Away' you've ever heard
Are we sure this isn't really Dennis DeYoung?37k
Kids reacting to the gay marriage decision is everything
We could all learn something from this video.6.1k
Bernie Sanders is $15 million closer to becoming president
Not too shabby, Bernie.4.4k
11-year-old badass rips out her loose tooth with a slingbow
Don't try this at home?
The 3 biggest questions heading into the ESL ESEA final
The first edition of the ESL ESEA Pro League is coming to a head this weekend with $250,000 on the line.29