6 ms·
Still missing details on how this qualifies as an APT, this seems nothing more than a basic trojan horse unless Kaspersky is for whatever reason neglecting to t
by snuxoll 10y ago
Still missing details on how this qualifies as an APT, this seems nothing more than a basic trojan horse unless Kaspersky is for whatever reason neglecting to talk about whatever persistence mechanisms it has in place beyond the basics (startup entry of some form).
Malware explicitly targeting crypto software is scary regardless, however.
- jcrawfordor 10y agoThe "persistent" in APT refers to the threat actor, not the tools themselves. So this is an APT because the threat actor has shown persistence by e.g. using multiple SWCs over a period of time and evolving their techniques. The individual tools used by the threat actor may not persist and in fact often don't, as APTs are much more likely to cover their tracks since they have a longer-term vision.
- nerdy 10y agoNot to mention they can reinfect via download and the malware scans the system[1] for: - putty.exe - filezilla.exe - winscp.exe - mstsc.exe - mRemoteNG.exe The malware also has the capabilities to fetch new instructions, so there's no telling what happens when any particular software is detected. [1] https://securelist.com/blog/research/76147/on-the-strongpity-waterhole-attacks-targeting-italian-and-belgian-encryption-users https://securelist.com/blog/research/76147/on-the-strongpity... (linked in the first line of this thread's article)