US health agencies account for the bulk of their target victims Trojan Stegoloader, a malicious malware that incorporates its code into archives PNG images, in an attempt to avoid detection mechanisms at the network and host level.
According to security experts, the largest number of infections is found in North America, affecting entities in various sectors, including financial, construction and technology businesses as well as oil and gas companies.
The Trojan Stegoloader, recently reported by Dell SecureWorks, is also known as Gatak. Its architecture is modular, which means its functionality can be extended to be used on a case-by-case basis according to the objectives of cyber criminals.
The technique used by the creators of Trojan is called segregation, and is commonly used in malware to update configuration files, or even to deliver malware. Although this method is not new, it is not widespread as an attack technique.
Another tactic used by trojan writers to avoid locating it is to run malicious modules in computer memory. The PNG image or the code extracted from it and decrypted, are not stored on the hard disk, leave no trace of infection in the storage drive, and escape detection through disk signature analysis.
According to Trend Micro telemetry data, 42,65% of Trojan Stegoloader victims come from the healthcare sector, followed by financial institutions with 12,81%.
Homemade Pacag, a security engineer at Trend Micro, believes that waterproofing can be used creatively in the future by cyber criminals who are investigating new ways of attacking health care providers to intercept medical data.
Dimitris hates Mondays...
