Babar: espionage software finally found and put under the microscope
Almost a year after Operation SNOWGLOBE was publicly mentioned for the first time by the famous French newspaper Le Monde, security experts have now laid hands on malware samples that match the descriptions made by the Communication Security Establishment Canada (CSEC). The following analysis is the…
Analysis of Project Cobra
Project Cobra and the Carbon System were mentioned by Kaspersky in the article called “The Epic Turla Operation” . This malware is used by the same actors as Uroburos (aka Snake/Turla) and Agent.BTZ. We estimate that Carbon System was developed after Agent.BTZ and before Uroburos. The Carbon System…
Regin, an old but sophisticated cyber espionage toolkit platform
Regin is one of the latest cyber espionage toolkits targeting a range or organizations, companies and individuals around the world. This malware is very sophisticated and it can mentioned in the same breath with other cyberespionage campaigns like Duqu, Stuxnet, Flame, Uroburos (aka Snake/Turla).…
UPDATE: The tool „Detekt“: what you should know about it
As reported, the recently launched tool “Detekt” is a tool to detect nation-state spyware by performing in-memory scans with the help of static Yara rules. G DATA appreciates the approach to raise awareness against spyware, but looking at the technical realization of the tool, we have to say that it…
The tool „Detekt“: what you should know about it
Amnesty International, Digitale Gesellschaft, Electronic Frontier Foundation and Privacy International jointly launched a tool named "Detekt". Primarily, they wish to raise awareness about spying actions against computer users and especially against activists and journalists. The tool is designed…
COM Object hijacking: the discreet way of persistence
G DATA SecurityLabs experts discovered a new Remote Administration Tool, which we dubbed COMpfun. This RAT supports 32-bit and 64-bit Windows versions, up to the Windows 8 operating system. The features are rather common for today’s espionage tools: file management (download and upload), screenshot…
New FrameworkPOS variant exfiltrates data via DNS requests
Between April and September 2014, the American retailer Home Depot was targeted by criminals who aimed to steal credit card information. The malware used during these attacks targets Point of Sale systems. Home Depot said that the cyber criminals stole 56 million of debit and credit card numbers…
Poweliks: the persistent malware without a file
When security researchers talk about malware, they usually refer to files stored on a computer system, which intends to damage a device or steal sensitive data from it. Those files can be scanned by AV engines and can be handled in a classic way. The following analysis is an example of malware which…
G DATA Malware Report July - December 2013
G DATA’s Malware Report H2 2013 includes the most important statistics and information regarding new malware types, websites’ threat potential as well as botnet and banking Trojan activities. Check out the essential facts.
Analysis of Uroburos, using WinDbg
Uroburos was already described as a very sophisticated and highly complex malware in our G DATA Red Paper, where we had a look at the malware’s behavior. This malware belongs to a specific type called rootkit. The general purpose of a rootkit is to modify the behavior of the system and, especially,…
Karsten Hahn
Principal Malware Researcher
Tim Berghoff
Security Evangelist
