Trend Micro says it detected a targeted attack that sent malware-laden emails to representatives of 16 European countries and some Asian governments.
The bogus emails purported to come from China’s defense ministry and contained a malicious attachment that exploited a now-patched vulnerability in Microsoft Office versions 2003 to 2010, wrote Jonathan Leopando, a technical communications specialist with Trend Micro.
If the email attachment is opened on an unpatched computer, a “backdoor” program is then installed that steals login credentials for websites and email credentials from Internet Explorer and Microsoft Outlook, Leopando wrote.
The stolen information was then sent to two IP addresses in Hong Kong, although those servers have since been shut down, he wrote.
The targets of the attack would suggest that hackers were looking for victims in the diplomatic community. Leopando noted that similar emails were also sent to some Chinese media organizations.
“The topic of the email—and the attached document—would be of interest to these targets,” Leopando wrote. “In addition, the information stolen and where it was stolen from—is very consistent with targeted attacks aimed at large organizations that use corporate mainstays like Internet Explorer and Outlook.”