Researchers at Russian security company Doctor Web discovered a new piece of malware used by malicious actors to target some of the largest construction crane manufacturers in Russia.
The Windows Trojan, dubbed by the security firm BackDoor.Crane.1, has been spotted in attacks aimed at two major companies specializing in cranes and auxiliary equipment. When the malware was discovered, it had been stealing confidential information from infected systems for some time.
BackDoor.Crane has been used to steal financial documents, agreements and internal business correspondence, which has led experts to believe that the attacks are part of a corporate espionage campaign conducted by “unscrupulous rivals.”
Once it infects a device, the malware contacts its command and control (C&C) server and waits for instructions. The attackers can install various modules, each designed to carry out certain activities, such as executing commands in the Command Prompt, downloading files from a specified link, uploading files via FTP or HTTP, and taking screenshots.
Dr. Web said some of the modules also downloaded a couple of Python-based Trojans. One of them, tracked as Python.BackDoor.Crane.1, can execute the same commands as BackDoor.Crane, but it can also get a list of files and folders from a specified path, delete files, terminate processes, copy files, and terminate itself.
The second piece of malware, Python.BackDoor.Crane.2, can open a shell on the infected device.
An “about” window left behind by mistake by the malware developers suggests that the first version of BackDoor.Crane was launched in 2015. However, Doctor Web said the samples analyzed by its researchers were compiled in April 2016. The security firm has published a detailed report on how the malware works and the traces it leaves on an infected system.
Related Reading: “Strider” Espionage Group Targets China, Russia, Europe
Related Reading: US Charges Chinese Worker for IBM With ‘Economic Espionage’
Related Reading: Chinese Attackers Conduct Cyberespionage for Economic Gain
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- In Other News: Government Use of Spyware, New Industrial Security Tools, Japan Router Hack
- Apple Denies Helping US Government Hack Russian iPhones
- Zero-Day in MOVEit File Transfer Software Exploited to Steal Data From Organizations
- Russia Blames US Intelligence for iOS Zero-Click Attacks
- Cisco Acquiring Armorblox for Predictive and Generative AI Technology
- Moxa Patches MXsecurity Vulnerabilities That Could Be Exploited in OT Attacks
- Organizations Warned of Salesforce ‘Ghost Sites’ Exposing Sensitive Information
- Organizations Warned of Backdoor Feature in Hundreds of Gigabyte Motherboards
Latest News
- Insider Q&A: Artificial Intelligence and Cybersecurity In Military Tech
- In Other News: Government Use of Spyware, New Industrial Security Tools, Japan Router Hack
- OpenAI Unveils Million-Dollar Cybersecurity Grant Program
- Galvanick Banks $10 Million for Industrial XDR Technology
- Information of 2.5M People Stolen in Ransomware Attack at Massachusetts Health Insurer
- US, South Korea Detail North Korea’s Social Engineering Techniques
- High-Severity Vulnerabilities Patched in Splunk Enterprise
- Idaho Hospitals Working to Resume Full Operations After Cyberattack
