Posted by Virus Bulletin on Mar 28, 2012
Tibetan NGOs targeted.
Researchers at Alienvault have discovered a targeted attack against Tibetan NGOs that uses a three-year-old vulnerability in Microsoft Office for Mac.
The attack exploits vulnerability MS09-027, which was discovered and subsequently patched by Microsoft in 2009. On unpatched systems, a specially crafted malicious document allows for remote code execution, giving the attacker full access to the victim's system.
The malware drops two trojans, one of which - 'MacControl' - was hitherto unknown and listens for commands from a command and control server.
The attack is not the first of its kind targeting Tibetan organisations and many believe the attackers are based in or have links with China. Indeed, the MacControl command and control server is hosted on a Chinese IP address.
Alienvault has more details on the attack here. Trend Micro recently wrote about a similar attack here.
Is your organisation vulnerable to targeted attacks? How seriously do you take the security of your Macs? Symantec.cloud's Martin Lee will discuss patterns and trends in targeted attacks at the VB seminar, while Sophos's Paul Baccas will talk about Mac security.
The VB seminar takes place 19 April 2012 at the OU Campus in Milton Keynes, UK.
Posted on 28 March 2012 by Virus Bulletin
