TajMahal cyber-espionage campaign uses previously unseen malicious tools

A newly discovered form of malware deployed as part of a highly stealthy cyber-espionage campaign comes with several new malicious functionalities. It appears to be the work of a completely new operation, with no known links to any known threat actors or hacking groups.

Dubbed TajMahal, after the file it uses to exfiltrate stolen data, the malware has a number of capabilities not previously seen in a backdoor.

These include stealing documents sent to the printer queue, the ability to steal files previously seen on removable drives as soon as they're available again, the ability to steal data burnt onto a CD by the victim, as well as the ability to take screenshots when recording audio from VoiceIP applications.

In addition to its unique capabilities, TajMahal provides attackers with what's described as a 'full-blown spying framework', with a backdoor into infected systems.

It can issue commands, take screenshots of the desktop and webcam, and use keylogging to steal usernames, passwords and other information. It can also open and exfiltrate documents with the help of its own file indexer for the victim's machine.

SEE: A winning strategy for cybersecurity (ZDNet special report) | Download the report as a PDF (TechRepublic)   

In addition, it can steal cryptography keys, grab browser cookies, gather the backup list for Apple mobile devices and more, with around 80 malicious modules each designed for espionage activity.

The malware has been uncovered by researchers at Kaspersky Lab, who have detailed their finding's at the company's Security Analyst Summit 2019 in Singapore.

Described as "a technically sophisticated APT framework designed for extensive cyber espionage," TajMahal was first uncovered in late 2018, but has been active for over five years, with the earliest sample dated to April 2013.

TajMahal was able to hide under the radar for so long because it has a completely new code base, with no similarities to known APTs or malware, and by employing an automatic update mechanism that's regularly used to deploy new samples to avoid detection.

However, researchers were alerted to the malware after Kaspersky security software flagged a file as suspicious.

"The file turned out to be a malicious plugin of a level of sophistication that suggested an APT - and the lack of code similarity to any known attack suggested it was a previously unknown APT," Alexey Shulmin, lead malware analyst at Kaspersky Lab told ZDNet.

"Using our knowledge of this file, we were able to identify more of them. That led us to the conclusion that the malware was part of a previously unknown, extremely rare, cyber-espionage platform," he added.

Tokyo and Yokohama  

Researchers believe the framework is based around two packages, dubbed Tokyo and Yokohama. Tokyo is the smaller of the two, containing just three modules, one of which is the main backdoor and a connection to a command-and-control server.

Yokohama, meanwhile, contains every other capability of TajMahal, indicating that Tokyo is likely to be the initial dropper that then delivers the full-blown malware as a second-stage download - with the dropper left installed in case it's needed for backup purposes later down the line.

The distribution method of TajMahal is still unknown and the infection has only been observed in the wild once - on the system of what's described as 'a diplomatic entity from a country in Central Asia', with the infection occurring in 2014.

Researchers note that this victim has previously been unsuccessfully targeted by Zebroacy (trojan malware associated with a Russian state-backed hacking group), although it's not thought the two campaigns are related.

SEE: Cybersecurity in an IoT and mobile world (ZDNet special report) | Download the report as a PDF (TechRepublic)

Nonetheless, due to the sophistication of the malware and its unique capabilities, it's unlikely that the diplomatic target is the only victim compromised by TajMahal in more than five years.

"The TajMahal framework is a very interesting and intriguing finding. The technical sophistication is beyond doubt and it seems unlikely that such a huge investment would be undertaken for only one victim. A likely hypothesis would be that there are other additional victims we haven't found yet," said Shulmin.

To help protect against attacks by new and unknown threat actors, researchers recommend that all software used throughout an organisation is up to date and that security patches designed to fix known vulnerabilities should be installed as a priority.

All Kaspersky Lab products have been updated to protect against TajMahal and researchers have provided a full analysis of the campaign on the Kaspersky blog.

READ MORE ON CYBERCRIME

• This malware turns ATM hijacking into a slot machine game
• The future of cyberwar: Weaponised ransomware, IoT attacks and a new arms race TechRepublic
• This Trojan attack adds a backdoor to your Windows PC to steal data
• Kaspersky Lab will warn you if your phone is infected with stalkerware CNET
• Trojan malware: The hidden cyber threat to your PC