New Malware 'Rover' Targets Indian Ambassador to Afghanistan
Summary: On December 24, 2015, Unit 42 identified an email-delivered attack on the Indian Ambassador to Afghanistan, using a spoofed message appearing to come from Defence Minister Manohar Parrikar and an RTF attachment named 'Appreciation_letter.doc' that exploited CVE-2010-3333 in Microsoft Word. The exploit downloaded a downloader Trojan from newsumbrella[.]net, which pulled the Rover payload and DLLs from 46.166.165.254 and installed a backdoor that took webcam photos via OpenCV, recorded audio via OpenAL, logged keystrokes, and exfiltrated files from fixed and removable drives.
What's compelling: Two of three Rover samples were undetected by every antivirus product on VirusTotal at the time of writing, so a campaign built from open-source libraries and lacking modern features still pulled screenshots, keystrokes and documents off a high-profile diplomat's Windows XP machine.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Mentions
- CVE-2010-3333
- Related
- CVE-2010-3333: Microsoft Office Stack-based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022Phishing Games Cyber Risks ·