During the course of ESET investigations several leads were discovered that indicate the threat has its origin in India and has been going on for at least two years.
This targeted attack used a code signing certificate issued to a seemingly legitimate company to sign malicious binaries and improve their potential to spread. The company was based in New Delhi, India and the certificate was issued in 2011. The malware spread through documents attached to emails.
"We have identified several different documents that followed different themes likely to be enticing to the recipients. One of these is the Indian armed forces. We do not have precise information as to which individuals or organizations were really specifically targeted by these files, but based on our investigations, it is our assumption that people and institutions in Pakistan were targeted," said Jean-Ian Boutin , ESET malware researcher.
For instance, one of the fake PDF files was delivered through a self-extracting archive called "pakistandefencetoindiantopmiltrysecreat.exe", and ESET telemetry data shows that Pakistan is heavily affected by this campaign with 79 percent of detections being in that country.
The first infection vector was utilizing a widely used and abused vulnerability known as CVE-2012-0158. This vulnerability can be exploited by specially crafted Microsoft Office documents and allows arbitrary code execution. The documents were delivered by email, and the malicious code was executed without the attacked computer user even knowing as soon as the document was opened.
The other infection vector was via Windows executable files appearing to be Word or PDF documents–again distributed via email. In both cases, to evade suspicion by the victim, fake documents are shown to the user on execution.
The malware was stealing sensitive data from infected PCs and sending it to the attackers' servers. It was using various types of data-stealing techniques, among them a key-logger, taking screenshots and uploading documents to attackers' computer. Interestingly, the information stolen from an infected computer was uploaded to the attacker's server unencrypted.
"The decision not to use encryption is puzzling considering that adding basic encryption would be easy and provide additional stealth to the operation," said Boutin.
This is a multi-part and multi-vector threat, below are ESET threat names related to this case:
Win32/VB.NVM TrojanWin32/VB.NWB Trojan