Remote access trojan targets Middle East-based energy and government sectors

Share this article:

A remote access trojan (RAT) that can hijack computers to steal data stored in browsers, log keystrokes and activate webcams has targeted high-level organizations in the Middle East.

According to a white paper (PDF) published by General Dynamics Fidelis Cybersecurity Solutions, the malware, dubbed “njRAT,” has been used specifically against the government, telecommunications and energy sectors in the region.

The white paper analyzed a variant of the trojan using a file, named “authorization.exe,” to deliver a payload to unsuspecting users. Attackers designed the executable to appear as Microsoft Word or PDF files when emailed to victims as attachments. The trojan also infects users via drive-by download and can spread through USB drives. It seeks to give its purveyors unlimited access to the networks of compromised organizations.

In addition to logging keystrokes, accessing the camera of infected computers and stealing login credentials, njRAT also allows its operators to upload or download files, view what's on a victim's desktop, and manipulate their system registry (to edit, delete or create keys and values). It can also update the malware with other malicious features.

“The ‘njRAT' is a robust remote access trojan that, once it reaches and infects the endpoint, allows the attacker to have full control over the victim system,” the white paper said. “With this access, the attacker can start scanning other systems in the victim network to perform lateral movement.”

The malware sends encrypted data to its command-and-control (C&C) server, including a string of text identifying its attack campaign. This allows those running the operation to keep track of malware dispatched for various purposes.

The C&C hub also receives the volume serial number of infected systems, the victim's computer name and machine location, the operating system used, and which version of the malware is on the machine, the white paper said.

Researchers warned that although the campaign is currently only targeting organizations in the Middle East, njRAT could easily be repurposed to infect others. Fidelis discovered that a site hosting the malware was linked to IP addresses in Vietnam and the U.K., but attackers are capable of faking their true locations.

A company representative could not be reached for comment on Tuesday.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

Beazley: employee errors root of most data breaches, but malware incidents cost ...

Insurance firm Beazley analyzed more than 1,500 data breaches it serviced between 2013 and 2014.

Apple issues seven updates, fixes more than 40 vulnerabilities in iOS 8, OS 10.9.5

Apple issues seven updates, fixes more than 40 ...

In one of its infrequent "Update Surprisedays," Apple plugged holes, boosted security and added features.

Canadian telecom co. Telus unveils first transparency report

The company received more than 100,000 government requests for customer data last year.