Menu
Cyberspy group repurposes 12-year-old Bifrose backdoor

Cyberspy group repurposes 12-year-old Bifrose backdoor

The group has been targeting organizations with ties to Asian governments since 2010

A group of hackers that primarily targets companies from key industries in Asia is using heavily modified versions of a backdoor program called Bifrose that dates back to 2004.

The group, which researchers from antivirus vendor Trend Micro call Shrouded Crossbow, has been targeting privatized government organizations, government contractors and companies from the consumer electronics, computer, healthcare, and financial industries since 2010.

The group's activities are evidence that engaging in cyberespionage doesn't always require huge budgets, stockpiles of zero-day vulnerabilities and never-before-seen malware programs. Old cybercrime tools can be repurposed and improved for efficient attacks.

This toolset used by the group includes backdoors such as Kivar and Xbow, which are based on or inspired by Bifrose and which in the past have been sold on underground markets for about $10,000.

"What we think happened is that the group purchased the source code of BIFROSE, and after improving its functions, the group then designed a new installation flow, developed a new builder to create unique loader-backdoor pairs, and made more simple and concise backdoor capabilities," the Trend Micro researchers said in a blog post.

This allowed them to remain effective in their operations, despite Bifrose being a very well known and understood threat in the antivirus industry as well as one that is easily detectable.

One interesting aspect about the group is that it is organized in at least two, but possibly three or more teams, according to the Trend Micro researchers. One is the development team, which has at least 10 people who develop new builds of the backdoor. The number of people involved was determined from version strings customized with unique developer IDs.

A second team is responsible for target selection, configuring the malware parameters for each intended victim and building the spear-phishing emails that are used as delivery mechanism. The rogue emails have malicious attachments and masquerade as news reports, resumes, government data or meeting requests.

A third team might be in charge of maintaining the group's extensive command-and-control infrastructure, which includes over 100 servers whose IP addresses and domains are updated in an organized fashion. New domains are being registered all the time, the Trend Micro researchers said.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Slideshows

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise

Ingram Micro completed its nationwide roadshow in Auckland last month, kicking off its Innovation Hour series with Hewlett Packard Enterprise. Uncovering the latest in storage, networking and servers, the event outlined key market trends for resellers in 2016 and beyond.

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise
IN PICTURES: FireEye celebrates channel at 2016 Partner Conference

IN PICTURES: FireEye celebrates channel at 2016 Partner Conference

FireEye welcomed 143 channel partners and distributors to FireEye's 2016 annual Partner Conference, FireEye A/NZ Momentum - held at Establishment in Sydney. Delegates heard from senior trans-Tasman channel leaders, marketing and the product divisions in the morning, with FireEye customers, incident responders and threat intelligence analysts sharing knowledge during the afternoon.

IN PICTURES: FireEye celebrates channel at 2016 Partner Conference
​IN PICTURES: Disruption in the data centre - Can the Kiwi channel capitalise?​

​IN PICTURES: Disruption in the data centre - Can the Kiwi channel capitalise?​

With New Zealand businesses now open to innovation, the industry sits on the cusp of significant disruption in the data centre. Driven by software-defined networking, the future of the data centre is fast becoming reality, as the channel seeks to keep up, keep innovating and keep growing. APC by Schneider Electric, Lenovo and key partners outlined how the channel can capitalise at The Grill restaurant in Auckland.

​IN PICTURES: Disruption in the data centre - Can the Kiwi channel capitalise?​
Show Comments