Researchers at Russian security company Doctor Web discovered a new piece of malware used by malicious actors to target some of the largest construction crane manufacturers in Russia.
The Windows Trojan, dubbed by the security firm BackDoor.Crane.1, has been spotted in attacks aimed at two major companies specializing in cranes and auxiliary equipment. When the malware was discovered, it had been stealing confidential information from infected systems for some time.
BackDoor.Crane has been used to steal financial documents, agreements and internal business correspondence, which has led experts to believe that the attacks are part of a corporate espionage campaign conducted by “unscrupulous rivals.”
Once it infects a device, the malware contacts its command and control (C&C) server and waits for instructions. The attackers can install various modules, each designed to carry out certain activities, such as executing commands in the Command Prompt, downloading files from a specified link, uploading files via FTP or HTTP, and taking screenshots.
Dr. Web said some of the modules also downloaded a couple of Python-based Trojans. One of them, tracked as Python.BackDoor.Crane.1, can execute the same commands as BackDoor.Crane, but it can also get a list of files and folders from a specified path, delete files, terminate processes, copy files, and terminate itself.
The second piece of malware, Python.BackDoor.Crane.2, can open a shell on the infected device.
An “about” window left behind by mistake by the malware developers suggests that the first version of BackDoor.Crane was launched in 2015. However, Doctor Web said the samples analyzed by its researchers were compiled in April 2016. The security firm has published a detailed report on how the malware works and the traces it leaves on an infected system.
Related Reading: "Strider" Espionage Group Targets China, Russia, Europe
Related Reading: US Charges Chinese Worker for IBM With 'Economic Espionage'
Related Reading: Chinese Attackers Conduct Cyberespionage for Economic Gain
Tags: