Facebook Twitter LinkedIn RSS
    Trending
    • SiBAN celebrates Interstellar’s groundbreaking contribution to Africa’s Blockchain ecosystem
    • Sophos expands solution to guide organizations to mitigate internal vulnerabilities
    • Businesses in Africa Get a Boost as TD Africa and Zebra Team Up to Accelerate Growth
    • Nnamani bags Digital Economy Icon of the Year Awards in Ghana
    • Nigeria’s Digital Awareness Programme Wins Top Global ICT Award
    • Nigeria Data Protection Commission fines MultiChoice Nigeria N766.2 million for privacy violations
    • New Horizons celebrates two decades of digital empowerment with AFRIBIS award
    • Verve: Powering Africa’s payment evolution for over 15 years
    Facebook Twitter LinkedIn
    ITPulse.com.ngITPulse.com.ng
    • News
    • Interviews
    • Blogs
    • Analysis
    • Opinion
    • Videos
    • Press Releases
    • Pictures
    • Advertise
    ITPulse.com.ngITPulse.com.ng
    Home»Blogs»How attackers hide backdoor in software used by hundreds of large companies around the world
    Blogs 3 Mins Read

    How attackers hide backdoor in software used by hundreds of large companies around the world

    mmBy ITPulseAugust 17, 2017
    Facebook Twitter WhatsApp Pinterest LinkedIn Reddit Tumblr Email
    Kaspersky Lab, ShadowPad, cyberespionage, Cybersecurity
    Share
    Facebook Twitter LinkedIn Pinterest Email

     

    Kaspersky Lab experts have discovered a backdoor planted in a server management software product used by hundreds of large businesses around the world. When activated, the backdoor allows attackers to download further malicious modules or steal data. Kaspersky Lab has alerted NetSarang, the vendor of the affected software, and it has promptly removed the malicious code and released an update for customers.

    ShadowPad is one of the largest known supply-chain attacks. Had it not been detected and patched so quickly, it could potentially have targeted hundreds of organisations worldwide.

    In July, 2017 Kaspersky Lab’s Global Research and Analysis (GReAT) team was approached by one of its partners – a financial institution. The organisation’s security specialists were worried about suspicious DNS (domain name server) requests originating on a system involved in the processing of financial transactions.

    Further investigation showed that the source of these requests was server management software produced by a legitimate company and used by hundreds of customers in industries like financial services, education, telecoms, manufacturing, energy, and transportation. The most worrying finding was the fact that the vendor did not mean for the software to make these requests.

    Further Kaspersky Lab analysis showed that the suspicious requests were actually the result of the activity of a malicious module hidden inside a recent version of the legitimate software. Following the installation of an infected software update, the malicious module would start sending DNS-queries to specific domains (its command and control server) at a frequency of once every eight hours.

    The request would contain basic information about the victim system (user name, domain name, host name). If the attackers considered the system to be “interesting”, the command server would reply and activate a fully-fledged backdoor platform that would silently deploy itself inside the attacked computer. After that, on command from the attackers, the backdoor platform would be able to download and execute further malicious code.

    Following the discovery, Kaspersky Lab researchers immediately contacted NetSarang. The company reacted fast and released an updated version of the software without the malicious code.

    So far, according to Kaspersky Lab research, the malicious module has been activated in Hong Kong, but it could be lying dormant on many other systems worldwide, especially if the users have not installed the updated version of the affected software.

    While analysing the tools techniques and procedures used by the attackers, Kaspersky Lab researchers came to the conclusion that some similarities exist that point to PlugX malware variants used by the Winnti APT, a known Chinese-speaking cyberespionage group. This information, however, is not enough to establish a precise connection to these actors.

    “ShadowPad is an example of how dangerous and wide-scale a successful supply-chain attack can be. Given the opportunities to reach and data collection it gives to the attackers, most likely it will be reproduced again and again with some other widely used software component.

    Luckily NetSarang was fast to react to our notification and released a clean software update, most likely preventing hundreds of data stealing attacks against its clients. However, this case shows that large companies should rely on advanced solutions capable of monitoring network activity and detecting anomalies.

    This is where you can spot malicious activity, even if the attackers were sophisticated enough to hide their malware inside legitimate software,” said Igor Soumenkov, security expert, Global Research and Analysis Team, Kaspersky Lab.

    cyberespionage Cybersecurity Kaspersky Lab ShadowPad
    Share. Facebook Twitter Pinterest LinkedIn Tumblr Telegram Email
    mm
    ITPulse
    • Website
    • Facebook
    • Twitter
    • LinkedIn

    ITPulse is a wholly information technology communication (ICT) news website, with a special focus on the African continent. The website provides up-to-date biz-tech news, analysis and comprehensive and thorough insight into the continent's ICT terrain

    Related Posts

    Verve: Powering Africa’s payment evolution for over 15 years

    July 7, 2025

    Samsung poised to redefine smartphone experience with next-gen foldables

    July 4, 2025

    LG launches “Radio Optimism” campaign to spread “life’s good” through music

    July 4, 2025

    Leave A Reply Cancel Reply

    Subscribe to Updates

    Get the latest creative news from FooBar about art, design and business.

    Latest Posts

    SiBAN celebrates Interstellar’s groundbreaking contribution to Africa’s Blockchain ecosystem

    July 8, 2025

    Sophos expands solution to guide organizations to mitigate internal vulnerabilities

    July 8, 2025

    Businesses in Africa Get a Boost as TD Africa and Zebra Team Up to Accelerate Growth

    July 8, 2025
    About
    About

    Itpulse.com.ng is a wholly information technology communication (ICT) news website, with special focus on the African continent. The website provides up-to-date biz-tech news, analysis and a comprehensive and thorough insight info the continent's ICT terrain.

    Contact us: editorial@itpulse.com.ng

    Facebook Twitter LinkedIn RSS
    Latest Posts

    SiBAN celebrates Interstellar’s groundbreaking contribution to Africa’s Blockchain ecosystem

    July 8, 2025

    Sophos expands solution to guide organizations to mitigate internal vulnerabilities

    July 8, 2025

    Businesses in Africa Get a Boost as TD Africa and Zebra Team Up to Accelerate Growth

    July 8, 2025
    Popular Posts

    Nigeria’s Digital Awareness Programme Wins Top Global ICT Award

    July 8, 2025

    Nigeria Data Protection Commission fines MultiChoice Nigeria N766.2 million for privacy violations

    July 7, 2025

    SiBAN celebrates Interstellar’s groundbreaking contribution to Africa’s Blockchain ecosystem

    July 8, 2025
    © 2017 - 2025 Itpulse. Designed by Max Excellence.
    • Terms & Conditions
    • Privacy Policy
    • Advertise
    • Contact Us

    Type above and press Enter to search. Press Esc to cancel.