associated with the Stealth Falcon state-sponsored cyber espionage
group that abuses a built-in component of the Microsoft Windows
operating system to stealthily exfiltrate stolen data to
attacker-controlled server.
Active since 2012, Stealth Falcon is a sophisticated
hacking group known for targeting journalists, activists, and
dissidents with spyware in the Middle East, primarily in the United
Arab Emirates (UAE).
Dubbed Win32/StealthFalcon, named after the hacking
group, the malware communicates and sends collected data to its
remote command-and-control (C&C) servers using Windows
Background Intelligent Transfer Service (BITS).
BITS is a communication protocol in Windows that takes unused
network bandwidth to facilitate asynchronous, prioritized, and
throttled transfer of files between machines in the foreground or
background, without impacting the network experience.
BITS is commonly used by software updaters, including
downloading files from the Microsoft servers or peers to install
updates on Windows 10, messengers, and other applications designed
to operate in the background.
According to security researchers at cyber-security firm ESET,
since BITS tasks are more likely permitted by host-based firewalls
and the functionality automatically adjusts the data transfer rate,
it allows malware to stealthily operate in the background without
raising any red flags.
“Compared with traditional communication via API functions, the
BITS mechanism is exposed through a COM interface and thus harder
for a security product to detect,” the researchers say in a report[1] published today.
“The transfer resumes automatically after being interrupted for
reasons like a network outage, the user logging out, or a system
reboot.”
text, the malware first creates an encrypted copy of it and then
uploads the copy to the C&C server via BITS protocol.
After successfully exfiltrating the stolen data, the malware
automatically deletes all log and collected files after rewriting
them with random data in order to prevent forensic analysis and
recovery of the deleted data.
As explained in the report, Win32/StealthFalcon backdoor has not
only been designed to steal data from the compromised systems but
can also be used by attackers to further deploy more malicious
tools and update its configuration by sending commands through
C&C server.
“The Win32/StealthFalcon backdoor, which appears to have been
created in 2015, allows the attacker to control the compromised
computer remotely. We have seen a small number of targets in UAE,
Saudi Arabia, Thailand, and the Netherlands; in the latter case,
the target was a diplomatic mission of a Middle Eastern country,”
the researchers say.
its C&C servers and code base with a PowerShell-based backdoor
attributed to the Stealth Falcon group and tracked[2] by the Citizen Lab in
2016.
Read more http://feedproxy.google.com/~r/TheHackersNews/~3/nFFaKnwhpVQ/stealthfalcon-virus-windows-bits.html