Java exploit used in Red October cyberespionage attacks, researchers say

Seculert researchers identified a Java exploit and corresponding attack pages on Red October command and control servers

The hundreds of government, military and research organizations targeted in a large-scale cyberespionage operation dubbed Red October were not only attacked using malicious Excel and Word documents as previously believed, but also by using Web-based Java exploits, according to researchers from Israeli IT security firm Seculert.

Researchers from antivirus vendors Kaspersky Lab published the results of their investigation into Red October on Monday. According to their report, the victims were targeted via rogue email messages that contained malicious documents designed to exploit known vulnerabilities in Microsoft Excel and Word.

Costin Raiu, director of Kaspersky's global research and analysis team, said Monday that other methods of distributing the cyberespionage malware might have been used, but hadn't been identified yet.

However, while analyzing the command and control servers used in the campaign, security researchers from Seculert discovered a special folder containing a malicious Java applet -- Web-based Java application -- designed to exploit a Java vulnerability patched in October 2011.

The exploit found on the server was compiled in Feb. 2012, which reinforces the belief that these attackers preferred to target older, known vulnerabilities, not zero-day -- previously unknown -- ones, the Seculert researchers said Tuesday in a blog post.

The discovery was made possible because at some point the attackers switched from using PHP as the server-side scripting language on their command and control servers to CGI. Some older PHP-based attack pages were still left on the servers and accessing them in a browser revealed their source code, the Seculert researchers said.

Evidence suggests that the Web-based attack method continued to be used even after switching the infrastructure to CGI, Aviv Raff, Seculert's chief technology officer, said Tuesday. However, it's not clear if exploits for newer vulnerabilities in Java or other browser plug-ins have been used in the past few months, he said.

Further analysis is impossible at this time because the command and control servers have been shut down, most likely by the attackers in an attempt to cover their tracks, Raff said.

The attackers tricked individuals in the targeted organizations into visiting the attack pages by sending them rogue emails with links pointing to them, the Seculert researchers said. It's not clear what those emails said, because no copy has been recovered yet, but they probably had a news-based theme, Raff said.

The attack pages, the Java exploit itself and even the URL for the malware payload contained strings referencing "news," Raff said. In fact, after the attack page loaded the Java exploit, the victims' browsers were being redirected to legitimate news sites, including one based in Turkey, he said.

Interestingly enough, command and control servers used in the Flame cyberespionage campaign also contained a "NewsForYou" string, suggesting that a news theme was used in those attacks. It's not clear at this time if this is just a coincidence or if there's a connection between the two campaigns, Raff said.

Raff believes that Red October is the work of a group of hackers trying to obtain high-value information which they can later sell to interested parties, rather than the result of a nation state's cyberespionage efforts. Researchers from Kaspersky Lab, who first uncovered this cyberespionage operation, favor the same theory.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags intrusiononline safetysecuritySeculertExploits / vulnerabilitiesspywaremalwarekaspersky lab

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?