Dear Visitor,

Our system has found that you are using an ad-blocking browser add-on.

We just wanted to let you know that our site content is, of course, available to you absolutely free of charge.

Our ads are the only way we have to be able to bring you the latest high-quality content, which is written by professional journalists, with the help of editors, graphic designers, and our site production and I.T. staff, as well as many other talented people who work around the clock for this site.

So, we ask you to add this site to your Ad Blocker’s "white list" or to simply disable your Ad Blocker while visiting this site.

Continue on this site freely
  HOME     MENU     SEARCH     NEWSLETTER    
CUSTOMER RELATIONSHIP MANAGEMENT NEWS. UPDATED 14 MINUTES AGO.
You are here: Home / CIO Issues / Slingshot Malware Hides in Routers
Newly Discovered Slingshot Malware Hides in Routers
Newly Discovered Slingshot Malware Hides in Routers
Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
MARCH
12
2018
Researchers at Kaspersky Lab have discovered a sophisticated advanced persistent threat (APT) that has been used for cyber espionage in the Middle East and Africa from at least 2012 until February this year.

Dubbed 'Slingshot,' the malware attacks and infects its targets through compromised routers and can run in kernel mode, giving it full control over users' devices.

Several of the techniques employed by the cyber criminals behind Slingshot are unique, and researchers say it is highly effective at stealthy information gathering, hiding its traffic in marked data packets that it can intercept without trace from everyday communications.

To date, researchers have seen approximately 100 victims of Slingshot and its related modules, located in Kenya, Yemen, Afghanistan, Libya, Congo, Jordan, Turkey, Iraq, Sudan, Somalia and Tanzania.

The majority of victims appear to be targeted individuals, although public sector organizations and institutions have fallen victim too. Kenya and Yemen account for most of the victims found so far.

A Highly Advanced Intruder

Slingshot was discovered after researchers found a suspicious keylogger program and created a behavioral detection signature to see if the code appeared anywhere else, says the company.

This then triggered a detection that turned out to be an infected PC with a suspicious file inside the system folder named scesrv.dll. Upon further investigation, the file showed that despite appearing legitimate, the scesrv.dll module had malicious code embedded into it. Since this library is loaded by ‘services.exe,' a process that has system privileges, the poisoned library gained the same rights.

A highly advanced intruder had found its way into the very core of the computer, the researchers say.

Alexey Shulmin, lead malware analyst at Kaspersky Lab, describes Slingshot as a sophisticated threat that uses a wide array of tools and techniques, including kernel mode modules that have to date only been seen in the most advanced predators. The functionality is highly valuable and profitable for the attackers, which could explain why it has been around for at least six years.

Cyberespionage

Cyber espionage appears to be the main aim of Slingshot, with analysis suggesting it harvests screenshots, keyboard data, network data, passwords, USB connections, other desktop activity, clipboard data and more. Its kernel access effectively means it can steal whatever it wants.

The APT also features a variety of obfuscation techniques to help it evade detection. These include encrypting all strings in its modules, calling system services directly in order to bypass security product hooks, using a number of anti-debugging techniques and selecting which process to inject depending on the installed and running security solution processes.

Prevention Is Better

To avoid falling victim to this attack, Kaspersky Lab recommends implementing several measures, including using a proven corporate grade security solution in combination with anti-targeted attack.

The company advises users of Mikrotik routers should upgrade to the latest software version as soon as possible to ensure protection against known vulnerabilities.

In addition, it advises businesses to provide security staff with access to the latest threat intelligence data, which will arm them with helpful tools for targeted attack research and prevention, such as indicators of compromise, YARA and customized advanced threat reporting.

© 2018 ITWeb under contract with NewsEdge/Acquire Media. All rights reserved.

Image credit: iStock/Artist's concept.

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
MORE IN CIO ISSUES
CRM DAILY
NEWSFACTOR NETWORK SITES
NEWSFACTOR SERVICES
© Copyright 2018 NewsFactor Network. All rights reserved. Member of Accuserve Ad Network.