Cyberspy group repurposes 12-year-old Bifrose backdoor

The group has been targeting organizations with ties to Asian governments since 2010

A group of hackers that primarily targets companies from key industries in Asia is using heavily modified versions of a backdoor program called Bifrose that dates back to 2004.

The group, which researchers from antivirus vendor Trend Micro call Shrouded Crossbow, has been targeting privatized government organizations, government contractors and companies from the consumer electronics, computer, healthcare, and financial industries since 2010.

The group's activities are evidence that engaging in cyberespionage doesn't always require huge budgets, stockpiles of zero-day vulnerabilities and never-before-seen malware programs. Old cybercrime tools can be repurposed and improved for efficient attacks.

This toolset used by the group includes backdoors such as Kivar and Xbow, which are based on or inspired by Bifrose and which in the past have been sold on underground markets for about $10,000.

"What we think happened is that the group purchased the source code of BIFROSE, and after improving its functions, the group then designed a new installation flow, developed a new builder to create unique loader-backdoor pairs, and made more simple and concise backdoor capabilities," the Trend Micro researchers said in a blog post.

This allowed them to remain effective in their operations, despite Bifrose being a very well known and understood threat in the antivirus industry as well as one that is easily detectable.

One interesting aspect about the group is that it is organized in at least two, but possibly three or more teams, according to the Trend Micro researchers. One is the development team, which has at least 10 people who develop new builds of the backdoor. The number of people involved was determined from version strings customized with unique developer IDs.

A second team is responsible for target selection, configuring the malware parameters for each intended victim and building the spear-phishing emails that are used as delivery mechanism. The rogue emails have malicious attachments and masquerade as news reports, resumes, government data or meeting requests.

A third team might be in charge of maintaining the group's extensive command-and-control infrastructure, which includes over 100 servers whose IP addresses and domains are updated in an organized fashion. New domains are being registered all the time, the Trend Micro researchers said.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?