Malware creators reuse decades-old code
Security researchers from Kaspersky Lab and Kings College London have uncovered similarities between Turla attacks from 2011 and 2017 and an ancient advanced persistent threat that was used two decades ago to launch an attack against the US government's network.
The researchers (Juan Andres Guerrero-Saade and Costin Raiu from Kaspersky Lab and Thomas Rid and Danny Moore from Kings College London) have taken logs of Moonlight Maze, an attack that happened in the late 90's, from a now retired IT admin whose server has been used as a proxy to launch the attacks.
Looking at the logs, the researchers uncovered that the same code is still being used in attacks today.
"If the link between Turla and Moonlight Maze is proven, it would place the evolved threat actor alongside the Equation Group in terms of its longevity, as some of Equation’s command-and-control servers date back to 1996," the security researchers say.
"In the late 1990s, no one foresaw the reach and persistence of a coordinated cyber-espionage campaign. We need to ask ourselves why it is that attackers are still able to successfully leverage ancient code in modern attacks. The analysis of the Moonlight Maze samples is not just a fascinating archaeological study; it is also a reminder that well-resourced adversaries aren’t going anywhere, it’s up to us to defend systems with skills to match," Juan Andres Guerrero-Saade, senior security researcher, Global Research and Analysis Team Kaspersky Lab, says.
Details of the Cupboard Samples logs and scripts, as well as Indicators of Compromise and hashes to help organizations search for traces of these attack groups in their corporate networks can be found on this link.
Published under license from ITProPortal.com, a Future plc Publication. All rights reserved.
Photo Credit: Duc Dao/Shutterstock