Tibetan NGOs targeted.
Researchers at
Alienvault
have discovered a targeted attack against Tibetan NGOs that uses a three-year-old vulnerability in
Microsoft Office for Mac
.
The attack exploits vulnerability MS09-027, which was discovered and subsequently patched by
Microsoft
in 2009. On unpatched systems, a specially crafted malicious document allows for remote code execution, giving the attacker full access to the victim’s system.
The malware drops two trojans, one of which – ‘MacControl’ – was hitherto unknown and listens for commands from a command and control server.
The attack is not the first of its kind targeting Tibetan organisations and many believe the attackers are based in or have links with China. Indeed, the MacControl command and control server is hosted on a Chinese IP address.
Alienvault
has more details on the attack
here
.
Trend Micro
recently wrote about a similar attack
here
.
Is your organisation vulnerable to targeted attacks? How seriously do you take the security of your Macs? Symantec.cloud’s Martin Lee will discuss patterns and trends in targeted attacks at the
VB seminar
, while Sophos’s Paul Baccas will talk about Mac security.
The VB seminar takes place 19 April 2012 at the OU Campus in Milton Keynes, UK.
Posted on 28 March 2012 by
Virus Bulletin
Leave a Reply