{"id":11264,"date":"2016-02-09T05:30:22","date_gmt":"2016-02-09T10:30:22","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=11264"},"modified":"2020-02-26T11:05:20","modified_gmt":"2020-02-26T16:05:20","slug":"poseidon-apt-boutique","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/poseidon-apt-boutique\/11264\/","title":{"rendered":"The Poseidon’s Domain"},"content":{"rendered":"

Long gone are the days when hackers would make malware just for fun. Nowadays malware is there not to simply cripple a PC, as it once was, but rather to make money for those who have created and infected your computer with it. Cybercrime is an industry unto itself with both large and small players. Our GReAT experts have recently discovered another player in the space, which they have dubbed the Poseidon Group. Their research on this group was presented at the Security Analyst Summit 2016<\/a>.<\/p>\n

\"Poseidon<\/a><\/p>\n

While the research was presented in 2016, the group is hardly a new player. Campaigns from this group seem to have been active since 2005. The first sample that was found is dated back to 2001 Poseidon targets only Windows-based computers ranging from Windows 95 to Windows 8.1 and Windows Server 2012 in the latest samples discovered. The group has a special crush on the domain-based networks, which are typical for big companies and enterprises.<\/p>\n

\"Poseidon<\/a><\/p>\n

How Poseidon strikes<\/h3>\n

The attacks usually started with spear fishing \u2014 which is a term for common phishing, targeting certain individuals and not involving any mass spam campaigns. Usually it means that criminals turn to social engineering<\/a> to convince the victim to open a malicious letter.<\/p>\n

Once the victim has download the malicious file \u2014 usually a DOC or a RTF document which contains embedded malware \u2014 their computers are compromised. Interestingly enough the Poseidon\u2019s toolkit displays awareness of many anti-viruses and tries to either hide from them or attack these processes as a means of self-defense.<\/p>\n

\n

Come and see the very first publicly known English-Portuguese speaking targeted campaign #TheSAS2016<\/a> #WhoIsPoseidon<\/a> pic.twitter.com\/kRbprLA4PD<\/a><\/p>\n

\u2014 Kaspersky (@kaspersky) February 5, 2016<\/a><\/p><\/blockquote>\n