MSUpdater Trojan Smuggles Data as Windows Update Traffic

Wednesday, February 01, 2012



Researchers from Zscaler and Seculert have identified an active exploit of an unpatched Adobe Reader bug being employed in a spear-phishing campaign targeting government-related entities.

The attack begins as an email invitation to a conference with a malware-laden PDF attachment. Once a system is infected, the MSUpdater Trojan escapes detection by disguising itself as an MSN update application.

"The method of operation of many of the attacks is similar – a spearphishing email is sent with a PDF attachment of a fake industry related 'Conference Invitation'. The PDF file exploits zero-day vulnerabilities in Adobe Reader, and then installs the RAT [Remote Access Trojan] malware. The malware tries to stay under the radar of security products by pretending to be a 'Microsoft Windows Update' - hence the name 'MSUpdater' Trojan... One variant is using Windows Update-like HTTP requests to communicate with the command-and-control server. The other drops a file named msupdate.exe." said Aviv Raff, CTO at Seculert.

The attack appears to be targeting sensitive intellectual and proprietary property, and the malware is designed to seek out specific files for exfiltration.

"The attacks' purpose was indeed industrial espionage, mainly for stealing intellectual property. One of the main functions of a variant of this malware was to steal specific files and upload them to the C&C server," Raff explained.

According to the researchers, the origins and identity of that attackers is still a mystery, but they have confirmed the group has been actively conducting operations for at least several years.

"We were able to track similar attacks, from the same group of attackers, back to 2009... We don't have information about the people behind those attacks, however as all of them are targeting government-related organisations, it is highly reasonable to suspect that the attackers are high profile, maybe even a country," Raff said.

Zscaler and Seculert have produced a joint report on the MSUpdater Trojan and the nature of the targeted attacks which can be found here:


Possibly Related Articles:
Viruses & Malware
Adobe Zero Day Enterprise Security Windows Headlines Espionage hackers spear-phishing Targeted Attacks Exfiltration exploit MSUpdater Trojan Zscaler Seculert Aviv Raff
Post Rating I Like this!
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.