Researchers find unusual malware targeting Tibetan users in cyberespionage operation

The malware abuses the Windows Management Instrumentation (WMI) service to remain undetected, researchers from ESET said

Security researchers from antivirus vendor ESET discovered a piece of cyberespionage malware targeting Tibetan activists that uses unusual techniques to evade detection and achieve persistency on infected systems.

The malware, which was dubbed Win32/Syndicasec.A, bypasses the UAC (User Account Control) mechanism in Windows to run arbitrary commands with elevated privileges without prompting users for confirmation.

It exploits a design flaw in the Windows UAC whitelist functionality that was documents back in 2009 by a developer named Leo Davidson. In fact, the malware uses Davidson's proof-of-concept code with almost no modifications, said Alexis Dorais-Joncas, Security Intelligence Team Lead at ESET, Thursday in a blog post.

This technique is used to execute a second malicious component that registers a piece of Javascript code in the Windows Management Instrumentation (WMI) subsystem. WMI is a default Windows service that can execute scripts written by system administrators to automate administrative tasks.

The abuse of WMI in malware is not new, but is a rare occurrence, Dorais-Joncas said. "This technique has the excellent property (from the attacker's point of view) of not requiring any malicious code to be stored as a regular file on disk. This causes standard dynamic analysis tools such as Process Monitor to fail to clearly highlight the malicious activity."

The Stuxnet cyberespionage malware, which targeted Iran's nuclear fuel enrichment plant at Natanz, also used this technique, he said.

The rogue WMI script added by the malware makes HTTP requests to hardcoded URLs that point to the RSS feeds of free blog sites. The title tags of RSS entries in those feeds contain encrypted commands that, when decoded, reveal the URLs of the actual command-and-control (C&C) servers.

When contacted, the C&C servers serve obfuscated JavaScript code that gets evaluated and executed by the WMI script running on the infected computers. This code contains the commands issued by the attackers.

The ESET researchers infected a test machine with Win32/Syndicasec in order to monitor its traffic and found that the interactions between the C&C server and the malware didn't appear to be automated.

"Every day would bring different commands sent at non-regular time intervals, making it look just as if someone was sitting behind a console and manually controlling infected hosts," Dorais-Joncas said.

The observed commands suggested that the attackers were browsing through the machine's file system and were gathering details about its network settings, attached drives and running programs.

The ESET researchers located different versions of the master script, the oldest of which dated from July 2010, suggesting that this cyberespionage operation has been active for several years.

The domain names used for the C&C servers included references to Tibet, for example tbtworld.info and tbtsociety.info. The most recent C&C domain, which was set up in late April, is called nedfortibt.info.

The 'ned' in 'nedfortibt.info' is likely a reference to the National Endowment for Democracy (NED), a nonprofit foundation funded by the U.S. Congress that supports non-governmental groups who are working for democratic goals in over 90 countries and which is openly supportive of Tibetans in their relations with China, Dorais-Joncas said.

According to the ESET researchers, the infection scale of Win32/Syndicasec is small and strictly limited to Nepal and China.

"The lack of built-in commands [in the master script] prevents us from discovering the real end-goal of this operation," Dorais-Joncas said. "However, we can affirm that the various characteristics observed around this threat are similar to other espionage campaigns against Tibetan activists that we have observed."

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags securitymalwarespywareintrusioneset

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?