RAT scurries through Skype, bites Syrian activists

Powered by SC Magazine
 

BlackShades Remote Access Tool monitors keystrokes, drops malware, and takes screenshots.

A new remote access trojan (RAT) that contains surveillance capabilities is targeting anti-regime activists in Syria, the site of continuing violent conflicts.

Known as BlackShades, the tool was distributed via instant messages from hacked Skype accounts.

The attackers were  luring dissidents into installing the malware by pretending to be a trusted contact on Skype and encouraging them to download a .pif file that claims to be an important video, according to The Citizen Lab, a research group based at the University of Toronto which studies the cross between cyber security and human rights.

Once installed, the tool drops malicious programs that can remotely log keystrokes and take screenshots, according to the Electronic Frontier Foundation, a nonprofit digital advocacy group that coordinated with The Citizen Lab on the discovery.

"Evidence suggests that this campaign is being carried by the same pro-Syrian-government hackers responsible for the fake YouTube attack we reported in March, which lured Syrian activists in by advertising pro-opposition videos, stole their YouTube login credentials by asking them to login before leaving a comment, and installed surveillance malware disguised as an Adobe Flash Player update," the EFF's Eva Galperin and Morgan Marquis-Boire wrote in a blog post on Tuesday.

The post said that removing the trojan may not necessarily eliminate the threat because the attackers may have installed additional malicious code while they had control of the victim's machine.

"EFF urges Syrian activists to be especially cautious when downloading files over the internet, even in links that are purportedly sent by friends," Galperin and Marquis-Boire wrote. "As members of the Syrian opposition become more savvy in using encryption, satellite networks, and other tools to evade the Assad regime's extensive internet surveillance capabilities, pro-Syrian-government malware campaigns have increased in frequency and sophistication."

Opposition activists in Syria have been regularly targeted by malware this year, namely the Dark Comet RAT.

This article originally appeared at scmagazineus.com

Copyright © SC Magazine, US edition


RAT scurries through Skype, bites Syrian activists
 
 
 
Top Stories
Meet FABACUS, Westpac's first computer
GE225 operators celebrate gold anniversary.
 
NSW Govt gets ready to throw out the floppy disks
[Opinion] Dominic Perrottet says its time for government to catch up.
 
iiNet facing new copyright battle with Hollywood
Fighting to protect customer details.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  26%
 
Sourcing and strategy
  12%
 
IT infrastructure (servers, storage, networking)
  21%
 
End user computing (desktops, mobiles, apps)
  15%
 
Software development
  26%
TOTAL VOTES: 343

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  58%
 
No
  42%
TOTAL VOTES: 143

Vote