Energy companies targeted by Laziok Trojan

A Trojan is targeting firms in the energy industry, infiltrating systems in a bid to gather information about a company's operations.

The malware, discovered by researchers working at Symantec, found that most of the attacks involved victims in the petroleum, gas and helium industries, especially those based in the United Arab Emirates, which accounted for one in four attacks.

According to a blog post by Christian Tripputi, security response manager at Symantec, Saudi Arabia, Kuwait, and Pakistan each accounted for 10 per cent of the attacks, while firms in the UK and US accounted for five per cent each.

Tripputi said the attacks were detected in the first couple of months this year and the Trojan looks to create a beachhead on energy firms before sending in further malware to gather further information about the victims.

The initial infection vector involves the use of spam emails coming from the moneytrans[.]eu domain, which acts as an open relay Simple Mail Transfer Protocol (SMTP) server, according to Tripputi.

"These emails include a malicious attachment packed with an exploit for the Microsoft Windows Common Controls ActiveX Control Remote Code Execution Vulnerability (CVE-2012-0158)," he said. "This vulnerability has been exploited in many different attack campaigns in the past, such as Red October."

Tripputi added that the stolen data "enables the attacker to make crucial decisions about how to proceed further with the attack, or to halt the attack".

If the victim organisation is deemed to be interesting, additional Trojans and backdoors would then be installed.

"The attackers distributed customised copies of Backdoor.Cyberat and Trojan.Zbot which are specifically tailored for the compromised computer's profile," said Tripputi.

He said that threats were downloaded from a few servers operating in the US, UK, and Bulgaria.

The security researcher said the group behind the attack does not seem to be particularly advanced, as they exploited an old vulnerability and used their attack to distribute well-known threats that are available in the underground market.

"However, many people still fail to apply patches for vulnerabilities that are several years old, leaving themselves open to attacks of this kind. From the attacker's perspective, they don't always need to have the latest tools at their disposal to succeed," he said. "All they need is a bit of help from the user and a lapse in security operations through the failure to patch."