Rare spy malware hits diplomats of NGOs from Asia, Europe

A rare spy malware has hit diplomats and members of NGOs from Asia Africa and Europe in a series of targeted cyber attacks including spearphishing documents in Russian language while some were related to North Korea and used as a lure to download malwareBased on the affiliation of the discovered victims the researchers at cyber security firm Kaspersky were able to determine that the malware campaign known as MosaicRegressor was used in a series of targeted attacksThe campaign has so far not been linked to any known advanced persistent threat APT actorsThe researchers uncovered the APT espionage campaign that uses a very rarely seen type of malware known as a firmware bootkitThe UEFI bootkit used with the malware is a custom version of Hacking Teams bootkit leaked in 2015Although UEFI attacks present wide opportunities to the threat actors MosaicRegressor is the first publicly known case where a threat actor used a custom made malicious UEFI firmware in the wild said Mark Lechtik senior security researcher at Global Research and Analysis Team GReAT at KasperskyThis attack demonstrates that albeit rarely in exceptional cases actors are willing to go to great lengths in order to gain the highest level of persistence on a victims machineUEFI firmware is an essential part of a computer which starts running before the operating system and all the programs installed in itIf UEFI firmware is somehow modified to contain malicious code that code will be launched before the operating system making its activity potentially invisible to security solutionsKaspersky researchers found a sample of such malware used in a campaign that deployed variants of a complex multistage modular framework dubbed as MosaicRegressorThe framework was used for espionage and data gathering with UEFI malware being one of the persistence methods for this new previously unknown malware the researchers explainedThe malware initially installed on the infected device is a Trojandownloader a programme capable of downloading additional payload and other malwareDepending on the payload downloaded the malware could download or upload arbitrary files fromto arbitrary URLs and gather information from the targeted machine the findings showedThe use of leaked thirdparty source code and its customization into a new advanced malware once again raises yet another reminder of the importance of data security said Igor Kuznetsov principal security researcher at Kasperskys GReATOnce software be it a bootkit malware or something else is leaked threat actors gain a significant advantage he addedKeep scrolling to read more newsCatch up on all the latest Crime National International and Hatke news here Also download the new midday Android and iOS apps to get latest updates MidDay is now on Telegram Click here to join our channel middayinfomedialtd and stay updated with the latest newsThis story has been sourced from a third party syndicated feed agencies Midday accepts no responsibility or liability for its dependability trustworthiness reliability and data of the text Midday managementmiddaycom reserves the sole right to alter delete or remove without notice the content in its absolute discretion for any reason whatsoever