Cyberespionage campaign 'NetTraveler' siphoned data from hundreds of high-profile targets, researchers say

The operation compromised government institutions, companies and activists from around the world, researchers from Kaspersky Lab said

An ongoing cyberespionage campaign compromised over 350 high-profile victims from more than 40 countries over the past eight years, including political activists, research centers, governmental institutions, embassies, military contractors and private companies from various industries.

Researchers from antivirus vendor Kaspersky Lab named the campaign NetTraveler, after a string found in the main data stealing malware associated with the attacks.

The largest number of NetTraveler malware samples was created between 2010 and 2013, but the earliest samples identified have time stamps from 2005 and there's some evidence that the malware has been active since 2004, the Kaspersky researchers said Tuesday in a blog post.

NetTraveler, also known as Travnet, is designed to steal documents, primarily DOC, XLS, PPT, RTF and PDF, and to perform basic computer surveillance. However, some configurations target extended lists of files, including those with extensions like CDR, which are associated with Corel Draw, or DWG, DXF, CDW and DWF, which correspond to AutoCAD projects.

In addition to the NetTraveler malware, the attackers behind this campaign also used other backdoor-type malware including Saker, also known as Xbox, and PCRat, also known as Zegost.

The primary attack method consists of spear-phishing emails carrying malicious documents that exploit two remote code execution vulnerabilities that affect Microsoft Office, namely CVE-2012-0158 and CVE-2010-3333, in order to install the malware.

These vulnerabilities were fixed by Microsoft in 2012 and 2010 respectively, but they are still effective against targets that haven't deployed the patches and are commonly exploited to infect computers in targeted attacks, the Kaspersky researchers said in a report about the cyberespionage campaign released Tuesday.

There is no evidence that the NetTraveler attackers used advanced techniques like the exploitation of zero-day -- previously unknown -- vulnerabilities or sophisticated malware like rootkits, the researchers said. "It is therefore surprising to observe that such unsophisticated attacks can still be successful with high profile targets."

Based on an analysis of infection logs from several of the command and control (C&C) servers associated with this campaign that show activity going back to 2009, the Kaspersky researchers identified over 350 victims. However, considering that there are other C&C servers from where logs have not been obtained, the total number of victims is estimated to be around 1,000, they said.

"We have calculated the amount of stolen data stored on C&C servers to be 22+ gigabytes," the researchers said. "However this data represents only a small fraction which we managed to see -- the rest of it had been previously downloaded and deleted from the C&C servers by the attackers."

Detection statistics for NetTraveler samples collected from Kaspersky's network showed that the country with the highest number of infections is Mongolia, followed by Russia, India and Kazakhstan. The U.S. is not in the top 10.

The Kaspersky researchers estimate that the NetTraveler cyberespionage group has around 50 members, most of whom are native speakers of Chinese and have some knowledge of English. The group's most recent domains of interest include space exploration, nanotechnology, energy production, nuclear power, lasers, medicine and communications, the researchers said.

A small number of victims infected with the NetTraveler malware were also infected with the malware used in the Red October cyberespionage campaign that was reported by Kaspersky in January. These include a military contractor in Russia, an embassy in Iran, an embassy in Belgium, an embassy in Kazakhstan, an embassy in Belarus and a government entity from Tajikistan.

There were no direct links found between the NetTraveler and the Red October attackers, but the small overlap of victims is nonetheless interesting, the Kasperky researchers said. "These infections indicate that certain high profile victims are targeted by multiple threat actors; the target information is a valuable commodity."

More details about attribution, victim identities and links with other attack campaigns are included in a private report that will be shared with selected parties, including local authorities from countries where victims were identified, Kaspersky Lab said.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags intrusionsecuritydata breachExploits / vulnerabilitiesspywaremalwarekaspersky lab

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?