Malware campaign strikes Asian, European governments

security

Trend Micro says it detected a targeted attack that sent malware-laden emails to representatives of 16 European countries and some Asian governments.

The bogus emails purported to come from China’s defense ministry and contained a malicious attachment that exploited a now-patched vulnerability in Microsoft Office versions 2003 to 2010, wrote Jonathan Leopando, a technical communications specialist with Trend Micro. 

Microsoft patched the vulnerability in Office, CVE-2012-0158, more than a year ago although attackers are still frequently targeting it, including in the Safe and Taidoor campaigns, Leopando wrote.

If the email attachment is opened on an unpatched computer, a “backdoor” program is then installed that steals login credentials for websites and email credentials from Internet Explorer and Microsoft Outlook, Leopando wrote.

The stolen information was then sent to two IP addresses in Hong Kong, although those servers have since been shut down, he wrote.

The targets of the attack would suggest that hackers were looking for victims in the diplomatic community. Leopando noted that similar emails were also sent to some Chinese media organizations.

“The topic of the email—and the attached document—would be of interest to these targets,” Leopando wrote. “In addition, the information stolen and where it was stolen from—is very consistent with targeted attacks aimed at large organizations that use corporate mainstays like Internet Explorer and Outlook.”

Shop ▾
arrow up Amazon Shop buttons are programmatically attached to all reviews, regardless of products' final review scores. Our parent company, IDG, receives advertisement revenue for shopping activity generated by the links. Because the buttons are attached programmatically, they should not be interpreted as editorial endorsements.

Subscribe to the Security Watch Newsletter

Comments