Kaspersky Lab has recentlydiscovereda new business-oriented cyber-spying campaign called Grabit that was able to steal about10,000 files fromsmall/medium-sized organizations based mostly in Thailand, India and the US. The listof target sectors includes chemicals, nanotechnology, education, agriculture, media, construction and more.
Other countries affected are the UAE, Germany, Israel, Canada, France, Austria, Sri Lanka, Chile and Belgium.
“We see a lot of spying campaigns focused on enterprises, government organizations and other high-profile entities, with small and medium-sized businesses rarely seen in the lists of targets. But Grabit shows that it’s not just a “big fish” game – in the cyber world every single organization, whether it possesses money, information or political influence, could be of potential interest to one or other malicious actor. Grabit is still active, and it’s critically important to check your network to ensure you’re safe. On May 15th a simple Grabitkeylogger was found to be maintaining thousands of victim account credentials from hundreds of infected systems. This threat shouldn’t be underestimated,” – says Ido Naor, Senior Security Researcher, Global Research & Analysis Team.
Infection starts when a user in a business organization receives an email with an attachment that appears to be a Microsoft Office Word (.doc) file. The user clicks to download it and the spying program is delivered to the machine from a remote server that has been hacked by the group to serve as a malware hub. The attackers control their victims using HawkEye keylogger, a commercial spying tool from HawkEyeProducts, and a configuration module containing a number of Remote Administration Tools (RATs).
To illustrate the scale of operation, Kaspersky Lab can reveal that a keylogger in just one of the command-and-control servers was able to steal 2887 Passwords, 1053 Emails and 3023 Usernames from 4928 different hosts, internally and externally, including Outlook, Facebook, Skype, Google mail, Pinterest, Yahoo, LinkedIn and Twitter, as well as bank accounts and others.
On the one hand, the Grabit threat actor does not go the extra mile to hide its activity: some malicious samples used the same hosting server, and even the same credentials, undermining its own security. On the other hand, the attackers use strong mitigation techniques to keep their code hidden from analysts’ eyes. This leads Kaspersky Lab to believe that behind the sniffing operation is an erratic group, with some members more technical and focused on being untraceable than others. Expert analysis suggests that whoever programmed the malware did not write all the code from scratch.
To protect against Grabit, Kaspersky Lab recommends following these rules:
Kaspersky Lab products detect all known Grabit samples and protect its users against the threat.
To learn more about the “Grabit” operation, please read the blog post available at Securelist.com.
We use cookies to make your experience of our websites better. By using and further navigating this website you accept this. Detailed information about the use of cookies on this website is available by clicking on more information.