By Pierluigi Paganini, Editor-in-Chief, CDM

Jun 05, 2013, 11:00 am EST

NetTraveler, this is the name of a new global cyber espionage campaign revealed  by researchers at Kaspersky, the team of experts discovered an espionage activity against over 350 high profile victims from 40 countries.

The name of the operation derives from the malicious code used in the attacks, the surveillance malware NetTraveler, once again the cyber espionage campaign seems to be originated from China as written in the report published by Kaspersky.

The NetTraveler campaign has been running since 2004 targeting  Tibetan/Uyghur activists, government institutions, energy companies as well as contractors and embassies.

Graph

The largest number of infections was observed in Mongolia, India and Russia but  also China and many other European countries were hit by the hackers such as Germany, the UK and Spain. Kaspersky’s team sustains that the group of hackers is composed of around 50 individuals, many of them Chinese-speaking but with a good knowledge of English.

Net Travellers

The scheme of attack is consolidated, a spear phishing campaign was used to deceive victims and trick them into opening files containing a malicious code that exploited two vulnerabilities in Microsoft Office including Exploit.MSWord.CVE-2010-333, Exploit.Win32.CVE-2012-0158.

The principal problem is that a great number of systems aren’t properly patched and so they are still vulnerable to exploits implemented by malware such as NetTraveler.

Net Config

The researchers analyzing the C&C servers used for NetTraveler campaign discovered more than 22 gigabytes of stolen data stored, the same servers were used to download on infected machines various malware at the time, majority of malicious code detected during the investigation were created between 2010 and 2013.

“however this data represents only a small fraction which we managed to see – the rest of the it had been previously downloaded and deleted from the c&c servers by the attackers.” the report states.

Another intriguing particular related to NetTraveler cyber espionage campaign is that 6 victims, including a military contractor in Russia and an embassy in Iran, were also hit by the Red October campaign revealed early this year by Kaspersky’s team.

“during our analysis of nettraveler infections, we identified several victims that were infected both by nettraveler and red october. Although we see no direct links between the nettraveler attackers and the red october threat actor, the existence of victims infected by both of these campaigns is interesting.”

(Source: CDM & Security Affairs – Cyber espionage, NetTraveler)