Lurid Malware Attack Infects 1,465 PCs in 61 Countries
Hackers have infiltrated servers of government and private organizations in 61 countries through an advanced persistent threat (APT) campaign called Lurid, according to computer security company Trend Micro.
The attack uses the "Lurid" downloader malware toolkit to infect and steal information from a total 1,465 computers in Russia, the former republics of the USSR, Vietnam, India and China. Computers of diplomatic missions, government ministries, space-related government agencies and other companies and research institutions were the targets.
The malware was deployed through vulnerabilities in common apps like Adobe Reader and screensavers. It then links the infected computer to the hackers' command and control servers.
"Trend Micro found that the downloader could install malware as a Windows service. It could also copy itself into the system folder and "ensure persistence by changing the common startup folder in Windows," according to Infoworld.com.
Trend Micro failed to identify the organization or country behind the Lurid downloader. The command and control centres, however, use IP addresses in the U.S. and the UK while the domain registration information points to China.
The Lurid attack is not the first APT campaign that happened. Last week, another APT targeted Japanese defense contractors, including Mitsubishi Heavy Industries.
McAfee discovered early this year the Night Dragon campaign that used zero-day malware and direct server attack on Western energy companies.