A fresh zero-day vulnerability in the Java software matches malware and networks used in the Bit9 breach.
According to a post by security blogger Brian Krebs, the Java exploit used in this attack downloaded a remote access Trojan called McRat that calls home to a malicious control server at the same malware and control server that was used in the attack on Bit9.
Alex Lanstein, a senior security researcher at FireEye, that highlighted the flaw in a blog, said it is likely that it is the same group that hit Bit9. The discovery of the Java zero-day is co-credited to FireEye and CyberESI, with FireEye saying that multiple customers had been attacked through versions Java 6 Update 41 and Java 7 Update 15.
A post by Symantec Security Response said that the final payload in the attack consisted of a DLL file, that it detected as Trojan.Naid, which connects to a command and control (C&C) server at 22.214.171.124. “Interestingly, a Trojan.Naid sample was also signed by the compromised Bit9 certificate discussed in the Bit9 security incident update and used in an attack on another party. This sample also used the back channel communication server IP address 126.96.36.199,” it said.
“The Trojan.Naid attackers have been extremely persistent and have shown their sophistication in multiple attacks. Their primary motivation has been industrial espionage on a variety of industry sectors. The attackers have employed multiple zero-days.”
The initial stage of the attack involves a target visiting a compromised site that hosts a malicious Jar file, detected by Symantec as Trojan.Maljava.B. The Jar file contains the exploit CVE-2013-1493 that, if successful, downloads a file called svchost.jpg that is actually an MZ executable, detected by Symantec as Trojan.Dropper. This executable then acts as a loader for the dropped appmgmt.dll file, detected as Trojan.Naid.