Menu
Malware served through rogue Tor exit node tied to cyberespionage group

Malware served through rogue Tor exit node tied to cyberespionage group

There is strong evidence that it was used to target European government agencies, researchers from F-Secure said

A malware program distributed recently through a rogue server on the Tor anonymity network was also used in targeted attacks against European government agencies.

The malware has been dubbed OnionDuke by security researchers from antivirus firm F-Secure, who believe it is connected to MiniDuke, a cyberespionage threat of Russian origin that was used to attack NATO and European governments before its discovery in February 2013.

In October, Josh Pitts, a researcher with Leviathan Security Group, found a Tor exit node located in Russia that was wrapping malware with all executable files downloaded by users through the node. When browsing the Web anonymously through Tor, the traffic is passed through random relays inside the Tor network and then it goes back out on the Internet through one of the many so-called exit nodes run by volunteers around the world.

The rogue Russian exit node identified by Pitts was banned from the Tor network, but researchers from F-Secure analyzed the malware it distributed and found that upon installation, it was downloading additional malicious components from several command-and-control servers.

"We have, for instance, observed components dedicated to stealing login credentials from the victim machine and components dedicated to gathering further information on the compromised system like the presence of antivirus software or a firewall," the F-Secure researchers said in a blog post Friday.

One of the command-and-control domain names used by the malware was registered in 2011 by someone who used the alias John Kasai. At about the same time, the John Kasai name was used to register a number of other domains, including two used by MiniDuke.

"This strongly suggests that although OnionDuke and MiniDuke are two separate families of malware, the actors behind them are connected through the use of shared infrastructure," the F-Secure researchers said.

"Based on compilation timestamps and discovery dates of samples we have observed, we believe the OnionDuke operators have been infecting downloaded executables at least since the end of October 2013," the researchers said. Since at least February 2014, OnionDuke has also been distributed through infected executables in pirated software downloaded over BitTorrent.

The F-Secure researchers found what they describe as "strong evidence" that OnionDuke has also been used in targeted attacks against European government agencies, like MiniDuke, but they haven't identified the exact attack vectors used in those campaigns yet.

"On one hand is the 'shooting a fly with a cannon' mass-infection strategy through modified binaries and, on the other, the more surgical targeting traditionally associated with APT [advanced persistent threat] operations," they said.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags online safetysecurityf-securespywaremalware

Slideshows

Meet the leading HP partners in New Zealand...

Meet the leading HP partners in New Zealand...

HP has recognised its top performing partners in New Zealand at the second annual 2016 HP Partner Awards, held at a glittering bash in Auckland. The HP Partner Awards recognises and celebrates excellence, growth, consistency and engagement of its top partners. This year also saw the addition of several new categories, resulting in 11 companies winning across 11 award categories.

Meet the leading HP partners in New Zealand...
Channel comes together as Ingram Micro Showcase hits Auckland

Channel comes together as Ingram Micro Showcase hits Auckland

Ingram Micro outlined its core focuses for 2017 at Showcase in Auckland, bringing together the channel for a day of engaging keynotes, compelling breakout sessions and new technologies.

Channel comes together as Ingram Micro Showcase hits Auckland
Show Comments