Researchers find unusual malware targeting Tibetan users in cyberespionage operation

The malware abuses the Windows Management Instrumentation (WMI) service to remain undetected, researchers from ESET said

Security researchers from antivirus vendor ESET discovered a piece of cyberespionage malware targeting Tibetan activists that uses unusual techniques to evade detection and achieve persistency on infected systems.

The malware, which was dubbed Win32/Syndicasec.A, bypasses the UAC (User Account Control) mechanism in Windows to run arbitrary commands with elevated privileges without prompting users for confirmation.

It exploits a design flaw in the Windows UAC whitelist functionality that was documents back in 2009 by a developer named Leo Davidson. In fact, the malware uses Davidson's proof-of-concept code with almost no modifications, said Alexis Dorais-Joncas, Security Intelligence Team Lead at ESET, Thursday in a blog post.

This technique is used to execute a second malicious component that registers a piece of Javascript code in the Windows Management Instrumentation (WMI) subsystem. WMI is a default Windows service that can execute scripts written by system administrators to automate administrative tasks.

The abuse of WMI in malware is not new, but is a rare occurrence, Dorais-Joncas said. "This technique has the excellent property (from the attacker's point of view) of not requiring any malicious code to be stored as a regular file on disk. This causes standard dynamic analysis tools such as Process Monitor to fail to clearly highlight the malicious activity."

The Stuxnet cyberespionage malware, which targeted Iran's nuclear fuel enrichment plant at Natanz, also used this technique, he said.

The rogue WMI script added by the malware makes HTTP requests to hardcoded URLs that point to the RSS feeds of free blog sites. The title tags of RSS entries in those feeds contain encrypted commands that, when decoded, reveal the URLs of the actual command-and-control (C&C) servers.

When contacted, the C&C servers serve obfuscated JavaScript code that gets evaluated and executed by the WMI script running on the infected computers. This code contains the commands issued by the attackers.

The ESET researchers infected a test machine with Win32/Syndicasec in order to monitor its traffic and found that the interactions between the C&C server and the malware didn't appear to be automated.

"Every day would bring different commands sent at non-regular time intervals, making it look just as if someone was sitting behind a console and manually controlling infected hosts," Dorais-Joncas said.

The observed commands suggested that the attackers were browsing through the machine's file system and were gathering details about its network settings, attached drives and running programs.

The ESET researchers located different versions of the master script, the oldest of which dated from July 2010, suggesting that this cyberespionage operation has been active for several years.

The domain names used for the C&C servers included references to Tibet, for example tbtworld.info and tbtsociety.info. The most recent C&C domain, which was set up in late April, is called nedfortibt.info.

The 'ned' in 'nedfortibt.info' is likely a reference to the National Endowment for Democracy (NED), a nonprofit foundation funded by the U.S. Congress that supports non-governmental groups who are working for democratic goals in over 90 countries and which is openly supportive of Tibetans in their relations with China, Dorais-Joncas said.

According to the ESET researchers, the infection scale of Win32/Syndicasec is small and strictly limited to Nepal and China.

"The lack of built-in commands [in the master script] prevents us from discovering the real end-goal of this operation," Dorais-Joncas said. "However, we can affirm that the various characteristics observed around this threat are similar to other espionage campaigns against Tibetan activists that we have observed."

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags intrusionsecurityesetspywaremalware

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?