Researchers from Trend Micro say they have discovered, a new backdoor family that is currently being installed using Java exploits delivered via drive-by downloads or compromised web sites.
The new backdoor family has been named BLYPT by Trend Micro, because of its use of binary large objects (blob) stored in the registry, as well as encryption.
According to the security firm, BLYPT enables an attacker to send commands to an affected system, such as:
• Receive updated DLL binary
• Receive updated configuration
• Receive HTTP request commands, such as Send GET requests to http://103.31.186.19:1000/FetchIP.aspx to retrieve public IP of affected machine
The servers behind these attacks are mainly centered in Romania and Turkey, while the threat is primarily hitting consumers in the United States, Trend said.
“In one case, we found a Java exploit that was used to spread this attack. This particular exploit, detected as JAVA_EXPLOYT.HI, can be used to run arbitrary code,” Trend Micro’s Maharlito Aquino noted in a blog post. “It exploits a vulnerability, CVE-2013-1493, that has been exploited since February 2013. It was patched in March.”
According to Maharlito, the exploit is used to download an installer, which then downloads and installs the main BLYPT component onto the affected system.
“It is named logo32.pngor logo64.png, depending on whether the user is running a 32-bit or 64-bit version of Windows, respectively,” Maharlito explained. “The installer attempts to connect to three servers every 3 seconds, until it successfully downloads the backdoor component. If it fails, it will retry up to 32 times before it gives up.”
The installer was also developed to provide instant feedback on the status of the install by accessing a URL on a malicious server, which serves as a status report.
Trend said it has identified two BLYPT variants, which can be identified based on the file name used to save the main BLYPT component. Both variants have 32- and 64-bit versions, and their behavior is mostly identical, though the location of where their C&C server information is stored is different.
Both variants encrypt their information using alleged (arc4) and use “http://microsoft.com” as the decryption key, Trend Said.
More details from Trend Micro are available here.
For more than 10 years, Mike Lennon has been closely monitoring the threat landscape and analyzing trends in the National Security and enterprise cybersecurity space. In his role at SecurityWeek, he oversees the editorial direction of the publication and is the Director of several leading security industry conferences around the world.
More from Mike Lennon
- Watch Now: Threat Detection and Incident Response Virtual Summit
- Registration Now Open: 2023 ICS Cybersecurity Conference | Atlanta
- NetRise Adds $8 Million in Funding to Grow XIoT Security Platform
- Virtual Event Today: Zero Trust Strategies Summit
- Virtual Event Tomorrow: Zero Trust Strategies Summit
- Watch: How to Build Resilience Against Emerging Cyber Threats
- Video: How to Build Resilience Against Emerging Cyber Threats
- Webinar Today: Understanding Hidden Third-Party Identity Access Risks
Latest News
- ChatGPT Hallucinations Can Be Exploited to Distribute Malicious Code Packages
- Blumira Raises $15 Million for SMB-Tailored XDR Platform
- Microsoft Will Pay $20M to Settle US Charges of Illegally Collecting Children’s Data
- KeePass Update Patches Vulnerability Exposing Master Password
- AntChain, Intel Create New Privacy-Preserving Computing Platform for AI Training
- Keep Aware Raises $2.4M to Eliminate Browser Blind Spots
- Google Workspace Gets Passkey Authentication
- Cybersecurity Startup Elba Raises €2.5 Million for Employee-Focused Product
