Report about hack threat to Tibetan activists used as lure in attack against them

Hackers trick Tibetan activists into visiting exploit pages by baiting them with a legitimate report from AlienVault

Hackers are using a recent report about cyberthreats to Tibetan activists as a lure in a new attack against pro-Tibet organizations that distributes Windows and Mac malware, researchers from security vendor AlienVault said on Monday.

On March 13, AlienVault published a report about email-based cyberattacks against Tibetan activist organizations including the Central Tibet Administration and the International Campaign for Tibet.

The rogue emails seen in those attacks distributed a booby-trapped Word document that exploited a Microsoft Office vulnerability (designated CVE-2010-3333) to install a variant of Gh0st RAT, a remote access computer Trojan.

AlienVault researchers believe that the Tibet attack campaign was organized by the same group of Chinese hackers that launched the so-called Nitro attacks against dozens of chemical sector companies last year.

However, it seems that even though the cyberespionage operation was exposed, hackers haven't given up on targeting pro-Tibet organizations. In fact, they started using AlienVault's report about the campaign as a lure in new attacks against Tibetan activists, said AlienVault researcher Jaime Blasco in a blog post on Monday.

Newly intercepted rogue emails that use spoofed headers to appear as originating from AlienVault warn recipients that Tibetan activist organizations have been targeted in recent cyberattacks.

The emails contain a "more information" link that leads visitors to a Web page displaying a copy of AlienVault's March 13 report. However, hidden JavaScript code present on the page launches exploits a known Java vulnerability (CVE-2011-3544) in the background, Blasco said.

Successful exploitation attempts result in computer backdoors being installed on both Windows and Mac OS X systems. The Mac backdoor had a zero detection rate on VirusTotal when scanned by AlienVault on Monday, Blasco said. Now, it is detected by six out of the 43 antivirus engines used by the service.

The Mac piece of malware connects to a command and control server hosted on a domain name that was associated in the past with attacks involving the Protux backdoor, Blasco said.

It's not clear whether the Nitro gang is responsible for the new attacks against Tibetan activists, but the group is known to have used similar techniques before. In December 2011, Symantec reported a series of malicious emails sent by the Nitro gang that used the company's original report about the group's operations as a lure.

CVE-2011-3544 exploits have been observed in many targeted attacks during the past month. Last Friday, Kaspersky Lab reported the same vulnerability being exploited in an attack against visitors to popular Russian news websites.

Microsoft also reported a spike in the usage of CVE-2011-3544 exploits, even though they have not been incorporated in popular drive-by download toolkits like Blackhole or Phoenix yet. Users are advised to update their Java installations and remove older versions from their systems in order to thwart attacks that leverage this vulnerability, Microsoft researchers said in a blog post on Tuesday.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Logitech Ultimate Ears Wonderboom Bluetooth Speaker

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?