APT: The Sykipot Campaign

Via TrendMico Malware Blog -

Last week reports surfaced about a “zero-day” exploit for Adobe Reader (CVE-2011-2462) that had been actively used in targeted attacks beginning in November. The malicious PDFs were emailed to targets along with text encouraging the target to open the malicious attachment. If opened, the malware known as BKDR_SYKIPOT.B installs onto the target system. The reported targets have been the defense industry and government departments.

Targeted attacks are typically organized into campaigns. Such a campaign commences as a series of attacks against a variety of targets over time – and not isolated “smash and grab” attacks. While information about any particular incident may be less than complete, over time we aim to assemble the various pieces (attack vectors, malware, tools, infrastructure, targeting) to gain a broader understanding of a campaign.

The Sykipot campaign, which has been known by many names over the years, can be traced back to 2007 and possibly 2006. Here, I will focus on a few key incidents, though there have been a variety of attacks consistently over the years.

A similar attack occurred in September 2011 that used a government medical benefits document as lure. This attack also leveraged a zero-day exploit in Adobe Reader (CVE-2010-2883). In March 2010, the malware was used in conjunction with a zero-day exploit of Internet Explorer 6. That’s three zero-day exploits in the last two years.

Another attack was reported in September 2009 that leveraged CVE-2009-3957 using information about a defense conference and the identity of a well-known think-tank as lure. In August 2009, there was another attack targeting government employees leveraging the theme of emergency management and the identity of the Federal Emergency Management Agency (FEMA) as lure. The same command and control (C&C) server used in this attack was also used in a 2008 attack.

Finally, an attack was reported in February 2007 that used malicious Microsoft Excel files (CVE-2007-0671) to drop malware that is functionally similar and most likely the predecessor of BKDR_SYKIPOT.B. The C&C server used in this attack was used in attacks dating back to 2006.

[...]

All of the samples over the years contain a backdoor functionality that allows the attackers to have a remote shell on the compromised computers. While the old versions execute shell commands via cmd.exe, the new ones execute via the winexec API. This provides the attackers with full remote control of the victim.

The Sykipot campaign remains a high priority threat.

-----------------------------------------------------------------------------------------------------

APT Attackers Maximize the Return on Exploit Investment (ROEI)

Given the research time it takes to find a new exploitable vulnerability and then develop a working and reliable exploit for that new vulnerability, it would make sense that the attackers want to maximize the return on their exploit 'investment'. Of course, the 'return' for these type of threat actors (APT) is not money, but the amount of sensitive data that can be obtained from the targeted companies. In this specific case, attackers were seen running unencrypted PDFs, AESv3 encrypted PDFs and at least two zero-day vulnerabilities in Adobe Reader. The use of AESv3 encrypted PDFs is of particular interest, given the AESv3 was implemented for developer purposes in Reader and is not widely used or an accepted standard..yet.