Backdoor found in ASEAN defence officials document

Powered by SC Magazine
 

File contains Australian defence officials' phone numbers and email addresses.

Criminals are exploiting interest in the ASEAN Defense Ministers Meetings (ADMM-Plus) to deliver malware to unsuspecting users.

The malware was delivered with a document labelled “ADMM-Plus Defence Officials Directory” that created a backdoor on unpatched machines.

The document itself was benign but contained potentially sensitive phone numbers and email addresses of defence officials from Australia, New Zealand and other members of the Association of South East Asian Nations.

Symantec researcher Takashi Katsuki discovered the document but did not reveal the names contained within it. SC has requested to view the file.

Attackers delivered the document and the payload through a file (.rtf) that exploited a Windows ActiveX remote code execution vulnerability (CVE-2012-0158). Once the file was opened, it dropped the document and the backdoor on machines.

The backdoor loaded after Windows users logged in and contacted a server based in China.

The vulnerability was already patched by Microsoft but had been exploited in a string of malware campaigns since its discovery in April this year.

It has been bound into document files for phishing attacks against Tibetan activists, Japanese steel companies and other industry sectors.               

Copyright © SC Magazine, Australia


Backdoor found in ASEAN defence officials document
Tags
 
 
 
Top Stories
Westpac interim CIO resigns
Group CIO yet to be appointed.
 
Earning the right to innovate
Breaking down the barriers to innovation is a long, but rewarding process, says Bank of Queensland Group CIO, Julie Bale.
 
A call for timely reporting
[Blog post] Businesses need incentives to keep customer data secure.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  26%
 
Application integration concerns
  3%
 
Security and compliance concerns
  28%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  22%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  5%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 898

Vote