Gazer cyber-spies exposed

ESET has released new research into the activities of the Turla cyberespionage group, and specifically a previously undocumented backdoor that has been used to spy on consulates and embassies worldwide.

ESET’s research team are the first in the world to document the advanced backdoor malware, which they have named “Gazer”, despite evidence that it has been actively deployed in targeted attacks against governments and diplomats since at least 2016.

Gazer’s success can be explained by the advanced methods it uses to spy on its intended targets, and its ability to remain persistent on infected devices, embedding itself out of sight on victim’s computers in an attempt to steal information for a long period of time.

ESET researchers have discovered that Gazer has managed to infect a number of computers around the world, with the most victims being located in Europe. Curiously, ESET’s examination of a variety of different espionage campaigns which used Gazer has identified that the main target appears to have been Southeastern Europe as well as countries in the former Soviet Union Republic.

The attacks show all the hallmarks of past campaigns launched by the Turla hacking group, namely:

• Targeted organisations are embassies and ministries;
• Spearphishing delivers a first-stage backdoor such as Skipper;
• A second stealthier backdoor (Gazer in this instance, but past examples have included Carbon and Kazuar) is put in place;
• The second-stage backdoor receives encrypted instructions from the gang via C&C servers, using compromised, kegitimate websites as a proxy.

Another notable similarity between Gazer and past creations of the Turla cyberespionage group become obvious when the malware is analysed. Gazer makes extra efforts to evade detection by changing strings within its code, randomizing markers, and wiping files securely.

In the most recent example of the Gazer backdoor malware found by ESET’s research team, clear evidence was seen that someone had modified most of its strings, and inserted phrases related to video games throughout its code.

Don’t be fooled by the sense of humour that the Turla hacking group are showing here, falling foul of computer criminals is no laughing manner.

All organisations, whether governmental, diplomatic, law enforcement, or in traditional business, need to take today’s sophisticated threats serious and adopt a layered defence to reduce the chances of a security breach.