NetTraveler, new global cyber espionage campaign from Kaspersky

By Pierluigi Paganini, Editor-in-Chief, CDM

Jun 05, 2013, 11:00 am EST

NetTraveler, this is the name of a new global cyber espionage campaign revealed  by researchers at Kaspersky, the team of experts discovered an espionage activity against over 350 high profile victims from 40 countries.

The name of the operation derives from the malicious code used in the attacks, the surveillance malware NetTraveler, once again the cyber espionage campaign seems to be originated from China as written in the report published by Kaspersky.

The NetTraveler campaign has been running since 2004 targeting  Tibetan/Uyghur activists, government institutions, energy companies as well as contractors and embassies.


The largest number of infections was observed in Mongolia, India and Russia but  also China and many other European countries were hit by the hackers such as Germany, the UK and Spain. Kaspersky’s team sustains that the group of hackers is composed of around 50 individuals, many of them Chinese-speaking but with a good knowledge of English.

Net Travellers

The scheme of attack is consolidated, a spear phishing campaign was used to deceive victims and trick them into opening files containing a malicious code that exploited two vulnerabilities in Microsoft Office including Exploit.MSWord.CVE-2010-333, Exploit.Win32.CVE-2012-0158.

The principal problem is that a great number of systems aren’t properly patched and so they are still vulnerable to exploits implemented by malware such as NetTraveler.

Net Config

The researchers analyzing the C&C servers used for NetTraveler campaign discovered more than 22 gigabytes of stolen data stored, the same servers were used to download on infected machines various malware at the time, majority of malicious code detected during the investigation were created between 2010 and 2013.

“however this data represents only a small fraction which we managed to see – the rest of the it had been previously downloaded and deleted from the c&c servers by the attackers.” the report states.

Another intriguing particular related to NetTraveler cyber espionage campaign is that 6 victims, including a military contractor in Russia and an embassy in Iran, were also hit by the Red October campaign revealed early this year by Kaspersky’s team.

“during our analysis of nettraveler infections, we identified several victims that were infected both by nettraveler and red october. Although we see no direct links between the nettraveler attackers and the red october threat actor, the existence of victims infected by both of these campaigns is interesting.”

(Source: CDM & Security Affairs – Cyber espionage, NetTraveler)

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

Global InfoSec Awards 2021

We are in our 9th year, and these awards are incredibly well received – helping build buzz, customer awareness, sales and marketing growth opportunities, investment opportunities and so much more.