Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

New Botnet Discovered Targeting Georgia Nationals

Researchers at ESET have discovered a botnet dubbed “Georbot”, a new botnet that targets victims living in the Eurasian state of Georgia. The information stealing Trojan is unusual to a degree, researchers said, given some of its functions and location of its command and control (C&C) server.

Researchers at ESET have discovered a botnet dubbed “Georbot”, a new botnet that targets victims living in the Eurasian state of Georgia. The information stealing Trojan is unusual to a degree, researchers said, given some of its functions and location of its command and control (C&C) server.

After some digging, ESET researchers were able to access the C&C used by the bot, and discovered some interesting features. The Trojan will look for and copy documents and certificates, as well as create audio and video recordings. Moreover, it can browse the local network connection in order to discover more information. The data that is harvested is sent to the C&C for later collection.

“One unusual aspect is that it will also look for “Remote Desktop Configuration Files” that enables the people receiving these files to connect to the remote machines without using any exploit. That approach will even bypass the need for RDP exploits such as the one that was revealed last week (MS12-20),” ESET’s Righard Zwienenberg wrote.

The Trojan attempts to hide from AV detection, and it has a backup plan in case the main C&C is offline – it connects to an alternate C&C hosted on a Georgian government domain.

“This does not automatically mean that the Georgian government is involved. Quite often people are not aware their systems are compromised. It should be also noted that the Data Exchange Agency of the Ministry of Justice of Georgia and its national CERT were fully aware of the situation…,” Zwienenberg added. A report on the botnet is available online.

Written By

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cybercrime

As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

Cybercrime

Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Cybercrime

Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.