Fresh Java exploit has ties to Bit9 attack

A fresh zero-day vulnerability in the Java software matches malware and networks used in the Bit9 breach.

The Java exploit used in the attack downloaded the McRAT remote access trojan which contacted the same malicious control server used in the attack on Bit9, KrebsonSecurity reported.

FireEye security researcher Alex Lanstein said the same group that hit Bit9 was likely behind the Java exploit.

A post by Symantec Security Response said that the final payload in the attack consisted of a DLL file, that it detected as Trojan.Naid, which connects to a command and control (C&C) server at 110.173.55.187.

“Interestingly, a Trojan.Naid sample was also signed by the compromised Bit9 certificate discussed in the Bit9 security incident update and used in an attack on another party. This sample also used the back channel communication server IP address 110.173.55.187,” it said.

“The Trojan.Naid attackers have been extremely persistent and have shown their sophistication in multiple attacks. Their primary motivation has been industrial espionage on a variety of industry sectors. The attackers have employed multiple zero-days.”

The initial stage of the attack involves a target visiting a compromised site that hosts a malicious Jar file, detected by Symantec as Trojan.Maljava.B.

The Jar file contains the exploit CVE-2013-1493 that, if successful, downloads a file called svchost.jpg that is actually an MZ executable, detected by Symantec as Trojan.Dropper. This executable then acts as a loader for the dropped appmgmt.dll file, detected as Trojan.Naid.

This article originally appeared at scmagazineuk.com