Targeted attacks and Ukraine - Revision history

Eric.freyssinet: Text replacement - " www.f-secure.com" to ""

2015-08-05T20:50:11Z

Text replacement - " www.f-secure.com" to ""

← Older revision		Revision as of 20:50, 5 August 2015
Line 1:		Line 1:
	{{Publication		{{Publication
	\|Type=Blogpost		\|Type=Blogpost
	\|Link=http://www.f-secure.com/weblog/archives/00002688.html ~~www.f-secure.com~~		\|Link=http://www.f-secure.com/weblog/archives/00002688.html
	\|Author=Mikko Hypponen, Timo Hirvonen		\|Author=Mikko Hypponen, Timo Hirvonen
	\|NomRevue=F-Secure Weblog		\|NomRevue=F-Secure Weblog

Eric.freyssinet: 1 revision imported

2015-02-07T14:30:30Z

1 revision imported

← Older revision		Revision as of 14:30, 7 February 2015
(No difference)

Eric.freyssinet at 21:08, 13 April 2014

2014-04-13T21:08:11Z

New page

{{Publication
|Type=Blogpost
|Link=http://www.f-secure.com/weblog/archives/00002688.html www.f-secure.com
|Author=Mikko Hypponen, Timo Hirvonen
|NomRevue=F-Secure Weblog
|Date=2014-04-01
|Editor=F-Secure
|Year=2014
|Botnet=MiniDuke
|Abstract=In 2013, a series of attacks against European governments was observed by Kaspersky Lab. The malware in question, known as MiniDuke, had many interesting features: it was tiny in size at 20KB. It used Twitter accounts for Command & Control and located backup control channels via Google searches. It installed additional backdoors onto the system via GIF files that embedded the malware.

As most APT attacks, MiniDuke was distributed via innocent looking document files that were emailed to targets. In particular, PDF files that exploited the CVE-2013-0640 vulnerability were used.

To investigate similar cases, we have created a tool for extracting the payloads and the decoy documents from MiniDuke PDF files. With this tool we were able to process a large batch of potential MiniDuke samples last week. While browsing the set of extracted decoy documents, we noticed several ones that had references to Ukraine. This is interesting considering the current crisis in the area.
}}