Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Tracking Elirks Variants in Japan: Similarities to Previous Attacks

Summary: Unit 42 reported that a recent, well-publicized attack on a Japanese business involved two malware families, PlugX and Elirks, the latter a basic backdoor Trojan first discovered in 2010 that retrieves its command-and-control address by reading encoded IP addresses or domain names posted in advance on a microblog or SNS account. The researchers found similarities to earlier Elirks attacks, including a May 2012 spear phishing email sent to a Taiwan ministry and an August 2012 file named "E-TKT" that exploited Adobe Flash vulnerability CVE-2011-0611 in an attached PDF to install the malware, but stated they have no reliable evidence the same adversary was responsible.

Bottom line: The command-and-control channel here is a blog or social media account the attacker set up years in advance - one created in 2014 was still live at the time of writing - so blocking known C2 infrastructure does nothing until someone finds the post. Unit 42 also notes it has seen multiple Elirks variants targeting Japan over the last few years, potentially indicating an ongoing cyber espionage campaign.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Mentions
CVE-2011-0611
Related
CVE-2011-0611: Adobe Flash Player Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022