Researchers find unusual malware targeting Tibetan users in cyberespionage operation

Security researchers from antivirus vendor ESET discovered a piece of cyberespionage malware targeting Tibetan activists that uses unusual techniques to evade detection and achieve persistency on infected systems.

The malware, which was dubbed Win32/Syndicasec.A, bypasses the UAC (User Account Control) mechanism in Windows to run arbitrary commands with elevated privileges without prompting users for confirmation.

It exploits a design flaw in the Windows UAC whitelist functionality that was documents back in 2009 by a developer named Leo Davidson. In fact, the malware uses Davidson’s proof-of-concept code with almost no modifications, said Alexis Dorais-Joncas, Security Intelligence Team Lead at ESET, Thursday in a blog post.

This technique is used to execute a second malicious component that registers a piece of Javascript code in the Windows Management Instrumentation (WMI) subsystem. WMI is a default Windows service that can execute scripts written by system administrators to automate administrative tasks.

The abuse of WMI in malware is not new, but is a rare occurrence, Dorais-Joncas said. “This technique has the excellent property (from the attacker’s point of view) of not requiring any malicious code to be stored as a regular file on disk. This causes standard dynamic analysis tools such as Process Monitor to fail to clearly highlight the malicious activity.”

The Stuxnet cyberespionage malware, which targeted Iran’s nuclear fuel enrichment plant at Natanz, also used this technique, he said.

The rogue WMI script added by the malware makes HTTP requests to hardcoded URLs that point to the RSS feeds of free blog sites. The title tags of RSS entries in those feeds contain encrypted commands that, when decoded, reveal the URLs of the actual command-and-control (C&C) servers.

When contacted, the C&C servers serve obfuscated JavaScript code that gets evaluated and executed by the WMI script running on the infected computers. This code contains the commands issued by the attackers.

The ESET researchers infected a test machine with Win32/Syndicasec in order to monitor its traffic and found that the interactions between the C&C server and the malware didn’t appear to be automated.

“Every day would bring different commands sent at non-regular time intervals, making it look just as if someone was sitting behind a console and manually controlling infected hosts,” Dorais-Joncas said.

The observed commands suggested that the attackers were browsing through the machine’s file system and were gathering details about its network settings, attached drives and running programs.

The ESET researchers located different versions of the master script, the oldest of which dated from July 2010, suggesting that this cyberespionage operation has been active for several years.

The domain names used for the C&C servers included references to Tibet, for example tbtworld.info and tbtsociety.info. The most recent C&C domain, which was set up in late April, is called nedfortibt.info.

The ‘ned’ in ‘nedfortibt.info’ is likely a reference to the National Endowment for Democracy (NED), a nonprofit foundation funded by the U.S. Congress that supports non-governmental groups who are working for democratic goals in over 90 countries and which is openly supportive of Tibetans in their relations with China, Dorais-Joncas said.

According to the ESET researchers, the infection scale of Win32/Syndicasec is small and strictly limited to Nepal and China.

“The lack of built-in commands [in the master script] prevents us from discovering the real end-goal of this operation,” Dorais-Joncas said. “However, we can affirm that the various characteristics observed around this threat are similar to other espionage campaigns against Tibetan activists that we have observed.”