Presented at
VB2015,
Oct. 1, 2015, 2 p.m.
(30 minutes)
With the geopolitical situation in Ukraine still in turmoil, targeted cyber-espionage attacks in the country continue to escalate. One of the attacks we analysed in depth last year was BlackEnergy (a.k.a. Sandworm). In 2015, one of the malware families we have been focusing on is another threat mostly active in post-Soviet countries: Potao.
Win32/Potao is a trojan that has recently been used (the most recent attacks were detected in July 2015) to spy on high-value targets such as Ukrainian government and military entities and one of the major Ukrainian news agencies. Other countries targeted by this universal cyber-espionage toolkit include Russia, Georgia and Belarus. In Russia, for example, the malware was used to spy on members of MMM, a popular financial pyramid scheme.
One of the most interesting discoveries during our Potao research was the connection to a Russian version of the popular open-source encryption software *TrueCrypt*. We discovered a website that has been serving a Russian-language-localized version of the *TrueCrypt* application that also contains a backdoor, targeting specific targets. In a few cases the trojanized *TrueCrypt* was used to install the Potao trojan.
In addition to an overview of the attack campaigns using Potao or the trojanized *TrueCrypt* (detected by *ESET* as Win32/FakeTC), we will also present the highlights of our detailed technical analysis of both trojans.
Recently, we have released a comprehensive whitepaper with details on our findings. The presentation will supplement a summary of key points already made public with our most recent discoveries, as well as possible links to other malware families and APT groups.
Presenters:
Links:
Similar Presentations: