Cyberespionage campaign 'NetTraveler' siphoned data from hundreds of high-profile targets, researchers say

The operation compromised government institutions, companies and activists from around the world, researchers from Kaspersky Lab said

An ongoing cyberespionage campaign compromised over 350 high-profile victims from more than 40 countries over the past eight years, including political activists, research centers, governmental institutions, embassies, military contractors and private companies from various industries.

Researchers from antivirus vendor Kaspersky Lab named the campaign NetTraveler, after a string found in the main data stealing malware associated with the attacks.

The largest number of NetTraveler malware samples was created between 2010 and 2013, but the earliest samples identified have time stamps from 2005 and there's some evidence that the malware has been active since 2004, the Kaspersky researchers said Tuesday in a blog post.

NetTraveler, also known as Travnet, is designed to steal documents, primarily DOC, XLS, PPT, RTF and PDF, and to perform basic computer surveillance. However, some configurations target extended lists of files, including those with extensions like CDR, which are associated with Corel Draw, or DWG, DXF, CDW and DWF, which correspond to AutoCAD projects.

In addition to the NetTraveler malware, the attackers behind this campaign also used other backdoor-type malware including Saker, also known as Xbox, and PCRat, also known as Zegost.

The primary attack method consists of spear-phishing emails carrying malicious documents that exploit two remote code execution vulnerabilities that affect Microsoft Office, namely CVE-2012-0158 and CVE-2010-3333, in order to install the malware.

These vulnerabilities were fixed by Microsoft in 2012 and 2010 respectively, but they are still effective against targets that haven't deployed the patches and are commonly exploited to infect computers in targeted attacks, the Kaspersky researchers said in a report about the cyberespionage campaign released Tuesday.

There is no evidence that the NetTraveler attackers used advanced techniques like the exploitation of zero-day -- previously unknown -- vulnerabilities or sophisticated malware like rootkits, the researchers said. "It is therefore surprising to observe that such unsophisticated attacks can still be successful with high profile targets."

Based on an analysis of infection logs from several of the command and control (C&C) servers associated with this campaign that show activity going back to 2009, the Kaspersky researchers identified over 350 victims. However, considering that there are other C&C servers from where logs have not been obtained, the total number of victims is estimated to be around 1,000, they said.

"We have calculated the amount of stolen data stored on C&C servers to be 22+ gigabytes," the researchers said. "However this data represents only a small fraction which we managed to see -- the rest of it had been previously downloaded and deleted from the C&C servers by the attackers."

Detection statistics for NetTraveler samples collected from Kaspersky's network showed that the country with the highest number of infections is Mongolia, followed by Russia, India and Kazakhstan. The U.S. is not in the top 10.

The Kaspersky researchers estimate that the NetTraveler cyberespionage group has around 50 members, most of whom are native speakers of Chinese and have some knowledge of English. The group's most recent domains of interest include space exploration, nanotechnology, energy production, nuclear power, lasers, medicine and communications, the researchers said.

A small number of victims infected with the NetTraveler malware were also infected with the malware used in the Red October cyberespionage campaign that was reported by Kaspersky in January. These include a military contractor in Russia, an embassy in Iran, an embassy in Belgium, an embassy in Kazakhstan, an embassy in Belarus and a government entity from Tajikistan.

There were no direct links found between the NetTraveler and the Red October attackers, but the small overlap of victims is nonetheless interesting, the Kasperky researchers said. "These infections indicate that certain high profile victims are targeted by multiple threat actors; the target information is a valuable commodity."

More details about attribution, victim identities and links with other attack campaigns are included in a private report that will be shared with selected parties, including local authorities from countries where victims were identified, Kaspersky Lab said.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags malwarespywareintrusionkaspersky labExploits / vulnerabilities

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?