Malware served through rogue Tor exit node tied to cyberespionage group

There is strong evidence that it was used to target European government agencies, researchers from F-Secure said

A malware program distributed recently through a rogue server on the Tor anonymity network was also used in targeted attacks against European government agencies.

The malware has been dubbed OnionDuke by security researchers from antivirus firm F-Secure, who believe it is connected to MiniDuke, a cyberespionage threat of Russian origin that was used to attack NATO and European governments before its discovery in February 2013.

In October, Josh Pitts, a researcher with Leviathan Security Group, found a Tor exit node located in Russia that was wrapping malware with all executable files downloaded by users through the node. When browsing the Web anonymously through Tor, the traffic is passed through random relays inside the Tor network and then it goes back out on the Internet through one of the many so-called exit nodes run by volunteers around the world.

The rogue Russian exit node identified by Pitts was banned from the Tor network, but researchers from F-Secure analyzed the malware it distributed and found that upon installation, it was downloading additional malicious components from several command-and-control servers.

"We have, for instance, observed components dedicated to stealing login credentials from the victim machine and components dedicated to gathering further information on the compromised system like the presence of antivirus software or a firewall," the F-Secure researchers said in a blog post Friday.

One of the command-and-control domain names used by the malware was registered in 2011 by someone who used the alias John Kasai. At about the same time, the John Kasai name was used to register a number of other domains, including two used by MiniDuke.

"This strongly suggests that although OnionDuke and MiniDuke are two separate families of malware, the actors behind them are connected through the use of shared infrastructure," the F-Secure researchers said.

"Based on compilation timestamps and discovery dates of samples we have observed, we believe the OnionDuke operators have been infecting downloaded executables at least since the end of October 2013," the researchers said. Since at least February 2014, OnionDuke has also been distributed through infected executables in pirated software downloaded over BitTorrent.

The F-Secure researchers found what they describe as "strong evidence" that OnionDuke has also been used in targeted attacks against European government agencies, like MiniDuke, but they haven't identified the exact attack vectors used in those campaigns yet.

"On one hand is the 'shooting a fly with a cannon' mass-infection strategy through modified binaries and, on the other, the more surgical targeting traditionally associated with APT [advanced persistent threat] operations," they said.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags online safetysecurityf-securespywaremalware

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?