Red October Campaign Revived with “CloudAtlas”

Threatpost.com reported on 10th December, 2014 quoting a warning of security experts as "The attackers behind the Red October APT (Advanced Persistent Attack) campaign which was first found nearly two years ago have now resurfaced with a new campaign nicknamed 'CloudAtlas'.

Researchers found the emergence of Red October in January 2013 and found that attackers were targeting diplomats in some Eastern Europe countries, research organizations and government agencies with malware which could steal data from mobile devices, desktops and FTP servers. The attackers had a wide variety of tools at their disposal and used unique IDs of victim and had exploits for many vulnerabilities.

Researchers of Kaspersky Lab recently disclosed the new CloudAtlas campaign which also uses that same spear phishing email luring and targeting some of the same victims hit by Red October. Researchers believe that the same group may be behind both campaigns based on similar tools, tactics and targets.

Greatest evidence related to ties to Red October lies in targeting information. CloudAtlas infections are now rigorous in Russia and previous Iron Curtain nations and India similar to Red October.

Both Red October and CloudAtlas malware instills rely on an analogous construct with a final payload and a loader which has hoarded encrypted and compressed in an exterior file. The employment of the compression algorithm is similar in both but the method it is appealed is little different with more input sanity verifications added to the CloudAtlas edition and finally, both families of malware use same type of configuration of the build system employed to pile up the binaries.

Finally, may be strongest linkage comes from targeting and CloudAtlas targets some of the victims of Red October as per the available information.

It is believed that Russian speakers have written Red October malware and it relied on exploits created by Chinese hackers for compromising computers.

Infosecurity.com published news on 10th December, 2014 quoting Kaspersky as saying "These and other facts make us consider that CloudAtlas signifies a rebirth of the Red October attacks."

» SPAMfighter News - 12/22/2014