Connect with us

Hi, what are you looking for?



New Trojan Used to Spy on Russian Crane Manufacturers

Researchers at Russian security company Doctor Web discovered a new piece of malware used by malicious actors to target some of the largest construction crane manufacturers in Russia.

Researchers at Russian security company Doctor Web discovered a new piece of malware used by malicious actors to target some of the largest construction crane manufacturers in Russia.

The Windows Trojan, dubbed by the security firm BackDoor.Crane.1, has been spotted in attacks aimed at two major companies specializing in cranes and auxiliary equipment. When the malware was discovered, it had been stealing confidential information from infected systems for some time.

BackDoor.Crane has been used to steal financial documents, agreements and internal business correspondence, which has led experts to believe that the attacks are part of a corporate espionage campaign conducted by “unscrupulous rivals.”

Once it infects a device, the malware contacts its command and control (C&C) server and waits for instructions. The attackers can install various modules, each designed to carry out certain activities, such as executing commands in the Command Prompt, downloading files from a specified link, uploading files via FTP or HTTP, and taking screenshots.

Dr. Web said some of the modules also downloaded a couple of Python-based Trojans. One of them, tracked as Python.BackDoor.Crane.1, can execute the same commands as BackDoor.Crane, but it can also get a list of files and folders from a specified path, delete files, terminate processes, copy files, and terminate itself.

The second piece of malware, Python.BackDoor.Crane.2, can open a shell on the infected device.

An “about” window left behind by mistake by the malware developers suggests that the first version of BackDoor.Crane was launched in 2015. However, Doctor Web said the samples analyzed by its researchers were compiled in April 2016. The security firm has published a detailed report on how the malware works and the traces it leaves on an infected system.

Advertisement. Scroll to continue reading.

Related Reading: “Strider” Espionage Group Targets China, Russia, Europe

Related Reading: US Charges Chinese Worker for IBM With ‘Economic Espionage’

Related Reading: Chinese Attackers Conduct Cyberespionage for Economic Gain

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Artificial Intelligence

The degree of danger that may be introduced when adversaries start to use AI as an effective weapon of attack rather than a tool...