Kaspersky researchers have discovered that malware dubbed WinDealer, spread by Chinese-speaking Advanced Persistent Threat (APT) actor LuoYu, has an ability to perform intrusions through a man-on-the-side attack. This groundbreaking development allows the actor to modify network traffic in-transit to insert malicious payloads. Such attacks are especially dangerous and devastating because they do not require any interaction with the target to lead to a successful infection.
Following the findings by TeamT5, Kaspersky researchers discovered a new distribution method applied by operators to spread the WinDealer malware. Specifically, they used a man-on-the-side attack to read traffic and insert new messages. The general concept of a man-on-the-side attack is that when the attacker sees a request for a specific resource on the network (through its interception capabilities or strategic position on the ISP’s network), it tries to reply to the victim faster than the legitimate server. If the attacker wins the ‘race’, the target machine will then use the attacker-supplied data instead of the normal data. Even if the attackers don’t win most ‘races’, they can try again until they succeed, guaranteeing that they will eventually infect most devices.
Following an attack, the target device receives a spyware application that can collect an impressive amount of information. The attackers are able to view and download any files stored on the device and run a keyword search on all documents. Generally, LuoYu targets foreign diplomatic organizations established in China and members of the academic community as well as defense, logistics and telecommunications companies. The actor uses WinDealer to attack Windows devices.
Typically, malware contains a hardcoded Command and Control server from which the malicious operator controls the entire system. With information about this server, it’s possible to block the IP-address of the machines that the malware interacts with, neutralizing the threat. However, WinDealer relies on a complex IP-generation algorithm to determine which machine to contact. This includes a range of 48,000 IP addresses, making it almost impossible for the operator to control even a small amount of the addresses. The only way to explain this seemingly impossible network behavior is by postulating that the attackers have significant interception capabilities over this IP range and can even read network packets that reach no destination.
The man-on-the-side attack is particularly devastating because it does not require any interaction with the target to lead to a successful infection: simply having a machine connected to the internet is enough. Moreover, there is nothing users can do to protect themselves, apart from routing traffic through another network. This can be done with a VPN, but these may not be an option, depending on the territory, and would typically not be available to Chinese citizens.
The vast majority of LuoYu victims are located in China, so Kaspersky experts believe that the LuoYu APT is predominantly focused on Chinese-speaking victims and organizations related to China. However, Kaspersky researchers have also noticed attacks in other countries, such as Germany, Austria, the United States, Czech Republic, Russia and India.
Geography distribution of WinDealer attacks
“LuoYu is an extremely sophisticated threat actor able to leverage functionality available only to the most mature attackers. We can only speculate as to how they were able to develop such capabilities. Man-on-the-side-attacks are extremely destructive as the only condition needed to attack a device is for it to be connected to the internet. Even if the attack fails the first time, attackers can repeat the process over and over again until they succeed. This is how they can carry out extremely dangerous and successful spying attacks on their victims, which typically include diplomats, scientists and employees of other key sectors. No matter how the attack has been carried out, the only way for potential victims to defend themselves is to remain extremely vigilant and have robust security procedures, such as regular antivirus scans, analysis of outbound network traffic and extensive logging to detect anomalies,” comments Suguru Ishimaru, Senior Security Researcher at Kaspersky’s Global Research and Analysis Team (GReAT).
Read the full report about WinDealer on Securelist.
To protect yourself from such an advanced threat, Kaspersky recommends:
Robust security procedures, involving regular antivirus scans, analysis of outbound network traffic and extensive logging to detect anomalies.
Carrying out a cybersecurity audit of your networks and remediating any weaknesses discovered on the perimeter of or inside the network.
Installing anti-APT and EDR solutions, enabling threat discovery and detection, investigation and timely remediation of incidents capabilities. Provide your SOC team with access to the latest threat intelligence and regularly upskill them with professional training. All of the above is available within Kaspersky Expert Security framework.
Along with proper endpoint protection, dedicated services can help against high-profile attacks. The Kaspersky Managed Detection and Response service can help identify and stop attacks in their early stages, before the attackers achieve their goals.
Being aware of new threats to maintain a high level of security for your business. Threat Intelligence Resource Hub provides access to independent, continuously updated and globally-sourced information on ongoing cyberattacks and threats, at no charge.
About Kaspersky
Kaspersky is a global cybersecurity and digital privacy company founded in 1997. Kaspersky’s deep threat intelligence and security expertise is constantly transforming into innovative security solutions and services to protect businesses, critical infrastructure, governments and consumers around the globe. The company’s comprehensive security portfolio includes leading endpoint protection and a number of specialized security solutions and services to fight sophisticated and evolving digital threats. Over 400 million users are protected by Kaspersky technologies and we help 240,000 corporate clients protect what matters most to them. Learn more at www.kaspersky.com.
