Microsoft has revealed a potentially damaging new spyware campaign targeting victims around the world.
In a blog post (opens in new tab), Microsoft claims that an Austrian company posing as a risk analysis and business intelligence service provider is in fact, a spyware developer responsible for Subzero, malware used against endpoints (opens in new tab) belonging to law firms, banks, and consultancy firms in the UK, Austria, and Panama.
The company, known as DSIRF, was found allegedly abusing zero-days exploits in both Windows and Adobe Reader to provide its customers with remote code execution capabilities, among other things. Before identifying the threat actor, Microsoft was tracking it under the codename KNOTWEED.
Commercial spyware
Before identifying the threat actor, Microsoft was tracking it under the codename KNOTWEED, and says it has now patched the vulnerabilities abused by DSIRF.
“MSTIC [Microsoft Threat Intelligence Center] has found multiple links between DSIRF and the exploits and malware used in these attacks. These include command-and-control infrastructure used by the malware directly linking to DSIRF, a DSIRF-associated GitHub account being used in one attack, a code signing certificate issued to DSIRF being used to sign an exploit, and other open-source news reports attributing Subzero to DSIRF,” Microsoft said in the blog.
As spotted by The Verge, Microsoft’s report was published while the company testified in front of the House Intelligence Committee, on “Combatting the Threats to U.S. National Security from the Proliferation of Foreign Commercial Spyware”. In the testimony, submitted in written form, Microsoft argues that in the past decade, there’s been a boom of commercial entities developing, and selling, spyware, to repressive regimes around the world.
“Over a decade ago, we started to see companies in the private sector move into this sophisticated surveillance space as autocratic nations and smaller governments sought the capabilities of their larger and better resourced counterparts,” it says in the testimony.
“In some cases, companies were building capabilities for governments to use consistent with the rule of law and democratic values. But in other cases, companies began building and selling surveillance as a service … to authoritarian governments or governments acting inconsistently with the rule of law and human rights norms.”
Microsoft has urged the U.S. to classify spyware as a “cyberweapon”.
- Keep your online activities to yourself with the best firewalls (opens in new tab) around
Via: The Verge (opens in new tab)
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba