AutoCAD worm steals blueprints in industrial theft

Share this article:

Researchers have uncovered another worm capable of industrial espionage, this time stealing "tens of thousands" of blueprints and product designs from computers in Peru.

Medrea is an information-stealing worm capable of ferreting out AutoCAD drawings on infected machines, and transferring the files by email to accounts based in China, ESET researchers said Thursday. The worm, dubbed ACAD/Medre.A, was discovered in February, but recently increased in activity, Righard Zwienenberg, a senior research fellow at the security firm, said in a blog post.

AutoCAD is popular among engineers and architects. The software is used to create computerized drawings for architectural designs, product schematics and floor plans of plants and factories.

Theft of AutoCAD has a serious impact on businesses because the intruders gain access to sensitive intellectual property even before the designs go into production, Zwienenberg said. Thieves could even apply for a patent before the actual owner.

Medrea modified native start-up files and employed Visual Basic Scripts so that it would be executed whenever an AutoCAD drawing was opened on the infected system, Zwienenberg said. Once the target computer is infected, every new design saved is automatically transferred via email to an account controlled by attackers.

Medrea also looked for and stole Outlook PST files containing email, calendars, contacts and other information. The worm also contained code to transfer Foxmail Address Book and the Foxmail Send Folder, but failed to do so because of errors in the code, Robert Lipovsky, a malware researcher at ESET, wrote in his technical analysis of the malware.

ESET suspects the malware was initially distributed via infected AutoCAD templates, and the high concentration of infections in Peru implies the compromised organizations had been working on projects within the country's public sector. While the malware was detected in other parts of Latin America, researchers believe Peru was the primary target.

ESET has created a free removal tool for organizations to scan and remove the malware.

This isn't the first time malware sought out AutoCAD drawings on infected computers.

The Flame malware, which infected a number of organizations in the Middle East, had a "high interest in AutoCAD drawings," Alexander Gostev, chief security expert at Kaspersky Lab, said in a statement earlier this month.

Duqu, another sophisticated espionage trojan that stole sensitive infrastructure-related data, also recognized AutoCAD documents.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters


More in News

ISSA tackles workforce gap with career lifecycle program

ISSA tackles workforce gap with career lifecycle program ...

On Thursday, the group launched its Cybersecurity Career Lifecycle (CSCL) program.

Amplification DDoS attacks most popular, according to Symantec

Amplification DDoS attacks most popular, according to Symantec

The company noted in a whitepaper released on Tuesday that Domain Name Server amplification attacks have increased 183 percent between January and August.

Court shutters NY co. selling security software with "no value"

A federal court shut down Pairsys at the request of the Federal Trade Commission.