Recent Blog Entries
exbane - Nov 28 2016 11:58 AM
Sharatie - Oct 28 2016 02:18 PM
mashti - Mar 06 2015 08:13 AM
cmylxgo - Mar 01 2015 09:45 PM
CCSA Checkpoint 156-215.77
mashti - Feb 20 2015 10:03 AM
svenables35 - Oct 07 2014 12:52 PM
dpuc - Aug 25 2014 02:21 PM
nikeldev - Jun 21 2014 06:44 PM
silenciovoid - May 06 2014 06:41 AM
Unregisterred - Mar 27 2014 09:43 AM
Powerful APT Malware “Slingshot” Performs Highly Sophisticated Cyber Attack to Compromise Router
Cyber criminals performing a highly sophisticated attack using APT Malware called Slingshot to compromise routers and gain the administrator level access.
Slingshot is one of the powerful cyber threat actor that mainly targeting individuals and organization and the major victims belong to Africa and the Middle East.
Researchers identified a malicious library function injection technique in the virtual file system that is an indication of APT interaction in the network.
Attackers compromised the Mikrotik routers using this Slingshot APT that will provide a complete router access.
Slingshot attacked 100 of victims who is located in Kenya, Yemen, Afghanistan, Libya, Congo, Jordan, Turkey, Iraq, Sudan, Somalia and Tanzania.
In mainly infected the many of individuals rather than an organisation but some of the attack indication referrers to few of government institution in Kenya and the Yemen.
Also Read: Beware of FlawedAmmyy RAT that Steals Credentials and Record Audio Chat
How Slingshot APT Attack Works
Slingshot APT attack very powerful creation by its authors and it developed with very sophisticated techniques to compromise the victims through a Windows exploit or compromised Mikrotik routers.
Initially victims runs the Winbox Loader software that downloads some DLLs by connecting to the router from routers file system which is already compromised and it contains malicious embedded code.
One of the DLL called “ipv4.dll” which is used to download other malicious components and run it into the users system.
later Slingshot will load a malicious modules in both kernel mode(Cahnadr) and user mode(GollumApp) and these module will play a major role to performing an information gathering operation and exfiltrate the sensitive data.
According to kaspersky researchers, To run its code in kernel mode in the most recent versions of operating systems, that have Driver Signature Enforcement, Slingshot loads signed vulnerable drivers and runs its own code through their vulnerabilities. .
Slingshot Also evade the security system and avoid detection by encrypting all strings and using a number of Anti-bug techniques.
After the complete infection, slingshot will collect the sensitive information such as screenshots, keyboard data, USB connections.
Since it have a kernel level access, slingsgot will collect all the relevant information it need such as credit card numbers, password hashes, social security account numbers etc.
Researchers haven’t seen Slingshot exploit any zero-days, but that doesn’t mean that it doesn’t – that part of a story is still unclear for us. But it does exploit known vulnerabilities in drivers to pass executable code into kernel mode. Kaspersky said.Router