Select Page

Cybersecurity researchers yesterday unveiled the existence of a highly sophisticated spyware framework that has been in operation for at least last 5 years—but remained undetected until recently.

Dubbed TajMahal by researchers at Kaspersky Lab, the APT framework is a high-tech modular-based malware toolkit that not only supports a vast number of malicious plugins for distinct espionage operations, but also comprises never-before-seen and obscure tricks.

Kaspersky named the framework after Taj Mahal, one of the Seven Wonders of the World located in India, not because it found any connection between the malware and the country, but because the stolen data was transferred to the attackers’ C&C server in an XML file named TajMahal.

TajMahal toolkit was first discovered by security researchers late last year when hackers used it to spy on the computers of a diplomatic organisation belonging to a Central Asian country whose nationality and location have not been disclosed.

However, malware samples examined by the researchers suggest the cyberespionage group behind the attack has been active since at least August 2014.

The TajMahal framework consists of two main packages—”Tokyo” and “Yokohama”—that together contain over 80 distinct malicious modules, which according to researchers, is one of the highest numbers of plugins ever seen for an APT toolset.

“It includes backdoors, loaders, orchestrators, C2 communicators, audio recorders, keyloggers, screen and webcam grabbers, documents and cryptography key stealers, and even its own file indexer for the victim’s machine,” the researchers say.

Researchers have not yet figured out how TajMahal infected its targets at the first place, but they do reveal that once accessed, first stage infection Tokyo is downloaded on targeted machines, which then deliver the fully-functional second-stage malware Yokohama.

images from Hacker News