New Targeted Attack Campaign Against Defense Contractors Under Way

The U.S. Defense industry once again is under siege by cyberspies in an attack that provides a link to a rigged spreadsheet containing a real list of high-level defense industry executives who attended a recent Intelligence Advanced Research Projects Activity (IARPA) event.

A Defense contractor friend of Anup Ghosh, CEO of Invincea, sent him a copy of a targeted yet suspicious email with the attachment he had received unsolicited. "He said he has been a nonstop target of a lot of spear-phishing attempts, but this one was very compelling because it was purported to have names of attendees to a recent IARPA meeting," Ghosh says. It appears that the attackers sent the same email and malicious attachment to the other 163 event attendees, he says.

The embedded URL -- which appears to be a subdomain of a domain that redirects to the legitimate research project website -- provides a ZIP archive to the attendee roster, which includes the names of directors, presidents, and CEOs of major Defense and intelligence companies.

"Unzipped, you see an XLS-looking file, but it's actually an executable," Ghosh says. "It extracts another custom program that's an HTTP client. This client beacons out to a server. You wouldn't notice it even if you were looking at your system process table: It looks like standard browser activity."

It's not until the system is rebooted, however, that the badness begins: The client reaches out to a command-and-control (C&C) server, which sends it another executable file. "That's the payload of the weapon," he says.

Dean De Beer and his team at ThreatGrid analyzed the executable, and found that it's a remote C&C Trojan hosted on a website. That Trojan gives the attackers full control of the victim's machine and Internet settings in the registry, and is able to update the root certificate lists that could be used for SSL man-in-the-middle attacks.

The researchers have alerted the targeted victims, as well as other members of the Defense industry and law enforcement.

They are unable to tell just how far the attackers got or what they might have stolen. "We would have to hack back into their server, and even then we may not see the actual data. But we don't do that, and we didn't do that," De Beer says. "We know the remote command-and-control built-in commands can exfiltrate data."

The attack appears to be an ongoing, active campaign targeting multiple Defense contractors, the researchers say, with similar methods but some different documents and executables. "The M.O. was the same," Invincea's Ghosh says.

Others have used different files but use the same outbound URL format as the "beaconing URLs" used in the IARPA event spear-phish, the researchers say.

The full attack analysis is available in an Invincea blog post here.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.