{"id":1740,"date":"2013-09-06T13:40:18","date_gmt":"2013-09-06T05:40:18","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=1740"},"modified":"2013-09-06T13:40:57","modified_gmt":"2013-09-06T05:40:57","slug":"nettraveler-is-back-with-new-tricks","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2013\/09\/06\/nettraveler-is-back-with-new-tricks\/","title":{"rendered":"NetTraveler is back with new tricks"},"content":{"rendered":"

Kaspersky Lab researchers recently announced a new attack vector of NetTraveler, an advanced persistent threat that has already infected hundreds of high profile victims in more than 40 countries.<\/strong><\/p>\n

According to Kaspersky Lab, an advanced persistent threat (APT) refers to a highly precise sort of cyberattack. APT can also refer to groups, often state sponsored or well-funded in other ways, that are responsible for launching such precision attacks. The end-goal of an APT-style attack is to compromise a machine on which there is some sort of valuable information.<\/p>\n

Known targets of NetTraveler (also known as \u201cTravnet\u201d, \u201cNetfile\u201d or “Red Star” APT) include Tibetan\/Uyghur activists, oil industry companies, scientific research centers and institutes, universities, private companies, governments and governmental institutions, embassies and military contractors.<\/p>\n

Immediately after the public exposure of the NetTraveler operations in June 2013, the attackers shut down all known command and control systems and moved them to new servers in China, Hong Kong and Taiwan. They also continued the attacks unhindered, just like the current case shows.<\/p>\n

Over the last few days, several spear-phishing e-mails were sent to multiple Uyghur activists. The Java exploit used to distribute this new variant of the Red Star APT was only recently patched in June 2013 and has a much higher success rate. The earlier attacks have used Office exploits (CVE-2012-0158) that was patched by Microsoft last April.<\/p>\n

In addition to the use of spear-phishing e-mails, APT operators have adopted the watering hole technique (web redirections and drive-by downloads on rigged domains) to infect victims surfing the web.<\/p>\n

Over the last month, Kaspersky Lab intercepted and blocked a number of infection attempts from the \u201cwetstock[dot]org\u201d domain, which is a known site linked to previous NetTraveler attacks.<\/p>\n

These redirections appear to come from other Uyghur-related websites that were compromised and infected by the NetTraveler attackers.<\/p>\n

Kaspersky Lab\u2019s Global Research and Analysis Team (GReAT) experts predict that other recent exploits could be integrated and used against the group\u2019s targets.<\/p>\n

The company\u2019s experts offer the following\u00a0 recommendations on how to stay safe from such attacks:<\/p>\n