{"id":3741,"date":"2019-09-24T11:11:23","date_gmt":"2019-09-24T08:11:23","guid":{"rendered":"https:\/\/blog.eset.ee\/?p=3741"},"modified":"2019-09-24T10:25:43","modified_gmt":"2019-09-24T07:25:43","slug":"eset-discovered-an-undocumented-backdoor-used-by-the-infamous-stealth-falcon-group","status":"publish","type":"post","link":"https:\/\/blog.eset.ee\/et\/en\/2019\/09\/24\/eset-discovered-an-undocumented-backdoor-used-by-the-infamous-stealth-falcon-group\/","title":{"rendered":"ESET discovered an undocumented backdoor used by the infamous Stealth Falcon group"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Stealth Falcon is a threat group, active since 2012,\nthat targets political activists and journalists in the Middle East. Some\nanalysts link it to Project Raven, an initiative allegedly employing former NSA\noperatives. Read more details on <a href=\"https:\/\/welivesecurity.com\/2019\/09\/09\/backdoor-stealth-falcon-group\/\">this\nlink<\/a>. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Limited technical information about Stealth Falcon has\nalready been made public, including an analysis of the key component of the\nmalware \u2013 a PowerShell-based backdoor delivered via a weaponized document that was\nincluded in a malicious email. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ESET researchers discovered a previously unreported\nexecutable backdoor they named Win32\/StealthFalcon. They have seen a small\nnumber of attacks with this malware in UAE, Saudi Arabia, Thailand, and the\nNetherlands; in the latter case, the target was a diplomatic mission of a\nMiddle Eastern country.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ESET research has revealed similarities between the\nnewly discovered executable backdoor and the PowerShell script with backdoor\ncapabilities previously attributed to the Stealth Falcon group. ESET researchers\nconsider the similarities to be strong evidence that both backdoors are the\nwork of the same group.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Win32\/StealthFalcon uses a rather unusual technique to\ncommunicate with its command and control (C&amp;C) server: the standard Windows\ncomponent Background Intelligent Transfer Service (BITS). <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Compared to traditional communication via API\nfunctions, the BITS mechanism is exposed through a COM interface and thus is\nharder to detect. Moreover, this design is reliable and stealthy, and more likely\nto be permitted by host firewalls.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In addition to its unusual C&amp;C communication, Win32\/StealthFalcon\nhas some advanced techniques to prevent detection\/analysis, ensure persistence\nand complicate forensic analysis. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For more details, read the blogpost \u201c<a href=\"https:\/\/welivesecurity.com\/2019\/09\/09\/backdoor-stealth-falcon-group\/\">ESET discovered an undocumented backdoor used by the infamous Stealth Falcon group<\/a>\u201d on WeLiveSecurity.com. Make sure to follow <a href=\"https:\/\/twitter.com\/ESETresearch\">ESET research on Twitter<\/a> for the latest news from ESET research.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Source: <a href=\"https:\/\/www.welivesecurity.com\/2019\/09\/09\/backdoor-stealth-falcon-group\/\">Welivesecurity<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Stealth Falcon is a threat group, active since 2012, that targets political activists and journalists in the Middle East. Some analysts link it to Project Raven, an initiative allegedly employing former NSA operatives. Read more details on this link. Limited technical information about Stealth Falcon has already been made public, including an analysis of the [&hellip;]<\/p>\n","protected":false},"author":5,"featured_media":3742,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[147],"tags":[],"class_list":["post-3741","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybercrime"],"acf":[],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/posts\/3741","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/comments?post=3741"}],"version-history":[{"count":0,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/posts\/3741\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/media\/3742"}],"wp:attachment":[{"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/media?parent=3741"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/categories?post=3741"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/tags?post=3741"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}