Stories
Slash Boxes
Comments

SoylentNews is people

posted by janrinok on Friday July 31 2015, @05:48PM   Printer-friendly
from the still-using-TrueCrypt? dept.

ESET's WeLiveSecurity blog has released details of Win32/Potao malware attack campaigns on high-value targets in Ukraine, Russia, Georgia and Belarus:

We presented our initial findings based on research into the Win32/Potao malware family in June, in our CCCC 2015 presentation in Copenhagen. Today, we are releasing the full whitepaper on the Potao malware with additional findings, the cyber-espionage campaigns where it was employed, and its connection to a backdoor in the form of a modified version of the TrueCrypt encryption software.

Like BlackEnergy, the malware used by the so-called Sandworm APT group (also known as Quedagh), Potao is an example of targeted espionage malware directed mostly at targets in Ukraine and a number of other post-Soviet countries, including Russia, Georgia and Belarus.

[...] An (A)PT malware family that has gone relatively unnoticed for five years and that has also been used to spy on Ukrainian governmental and military targets is certainly interesting in and of itself. However, perhaps the most attention-grabbing discovery related to this case was when we observed a connection to the popular open-source encryption software, TrueCrypt. We found out that the website truecryptrussia.ru has been serving modified versions of the encryption software that included a backdoor to selected targets. Clean versions of the application are served to normal visitors to the website, i.e. people who aren't of interest to the attackers. ESET detects the trojanized TrueCrypt as Win32/FakeTC. TrueCrypt Russia's domain was also used as a C&C server for the malware. The connection to Win32/Potao, which is a different malware family from Win32/FakeTC, is that FakeTC has been used to deliver Potao to victims' systems in a number of cases. FakeTC is not, however, merely an infection vector for Potao (and possibly other malware) but a fully functional and dangerous backdoor designed to exfiltrate files from the espionage victims' encrypted drives.

From The Register.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 3, Touché) by takyon on Friday July 31 2015, @05:58PM

    by takyon (881) <takyonNO@SPAMsoylentnews.org> on Friday July 31 2015, @05:58PM (#216424) Journal

    Spudnik jokes not admitted.

    --
    [SIG] 10/28/2017: Soylent Upgrade v14 [soylentnews.org]
    Starting Score:    1  point
    Moderation   +1  
       Funny=1, Overrated=1, Touché=1, Total=3
    Extra 'Touché' Modifier   0  
    Karma-Bonus Modifier   +1  

    Total Score:   3  
  • (Score: 2) by broggyr on Friday July 31 2015, @06:25PM

    by broggyr (3589) <broggyrNO@SPAMgmail.com> on Friday July 31 2015, @06:25PM (#216451)

    PO-TA-TOES!

    --
    Taking things out of context since 1972.
  • (Score: 2, Funny) by Runaway1956 on Friday July 31 2015, @06:41PM

    by Runaway1956 (2926) Subscriber Badge on Friday July 31 2015, @06:41PM (#216465) Journal

    Are these ones alright?

    1

    A Gentleman comes to the shop and asked,

            Give me a bottle of vodka and a bottle of Coca-cola.

    After Half an hour he comes again and asked again,

            Give me a bottle of vodka and a bottle of Coca-cola.

    After one hour he comes again and asked to the shopkeeper

            Give me a bottle of vodka and a bottle of... of Sprite. It seems Coca-cola makes me sick! :)

    2

    A patient went to a doctor. Patient was suffering from insomnia, nervous breakdown and Depression. After some checking the doctor said,

    Doctor: This medicine is for insomnia, this one is for nervous break-down, and also take this one for depression.

    Patient: Thank you very much, doctor, but do you have any other medicine besides vodka?
    3

    Tell us, what forces you to drink vodka every day?

            Nothing. I'm a volunteer.

    4

    The Traffic police stops a car.

    Policeman asked the man, Have you drunk vodka today?

    Driver: No.

    Policeman: Breathe into the tube... Well, no alcohol is detected... Maybe the tube is broken… (breathes into the tube himself) No, it's working!
    5

    Two Russian friends Went in a bar and ordered beer vodka.

    One of them adds: - Make sure the mug glass is clean!

    After a minute the waiter brings two beer mugs vodka glasses and asks: - Which of you ordered beer vodka in a clean mug glass?

    Courtesy: http://www.flowingevents.com/2012/01/5-best-russian-jokes-about-vodka.html [flowingevents.com]

  • (Score: 2) by goodie on Friday July 31 2015, @06:53PM

    by goodie (1877) on Friday July 31 2015, @06:53PM (#216473) Journal

    Damn. I though there was some super fast worm eating potatoes and that the world supply of chips was threatened.

  • (Score: 1) by Pino P on Friday July 31 2015, @08:08PM

    by Pino P (4721) on Friday July 31 2015, @08:08PM (#216518) Journal

    Especially because potato is from August 2000 [debian.org]. If you haven't had a woody by then, you're way behind.