Researchers from Zscaler and Seculert have identified an active exploit of an unpatched Adobe Reader bug being employed in a spear-phishing campaign targeting government-related entities.
The attack begins as an email invitation to a conference with a malware-laden PDF attachment. Once a system is infected, the MSUpdater Trojan escapes detection by disguising itself as an MSN update application.
"The method of operation of many of the attacks is similar – a spearphishing email is sent with a PDF attachment of a fake industry related 'Conference Invitation'. The PDF file exploits zero-day vulnerabilities in Adobe Reader, and then installs the RAT [Remote Access Trojan] malware. The malware tries to stay under the radar of security products by pretending to be a 'Microsoft Windows Update' - hence the name 'MSUpdater' Trojan... One variant is using Windows Update-like HTTP requests to communicate with the command-and-control server. The other drops a file named msupdate.exe." said Aviv Raff, CTO at Seculert.
The attack appears to be targeting sensitive intellectual and proprietary property, and the malware is designed to seek out specific files for exfiltration.
"The attacks' purpose was indeed industrial espionage, mainly for stealing intellectual property. One of the main functions of a variant of this malware was to steal specific files and upload them to the C&C server," Raff explained.
According to the researchers, the origins and identity of that attackers is still a mystery, but they have confirmed the group has been actively conducting operations for at least several years.
"We were able to track similar attacks, from the same group of attackers, back to 2009... We don't have information about the people behind those attacks, however as all of them are targeting government-related organisations, it is highly reasonable to suspect that the attackers are high profile, maybe even a country," Raff said.
Zscaler and Seculert have produced a joint report on the MSUpdater Trojan and the nature of the targeted attacks which can be found here:
Source: http://www.theregister.co.uk/2012/02/01/spear_phishing_rats/