New Malware Uses Twitter and an Invisibility Cloak

A new type of malware has been found that mimics the normal behavior of users.  It’s being called Hammertoss and is suspected as being used by group that is spying on behalf of the Russian government. The group, APT 29 has been in the news before being linked to the 2012 "Red October" campaign and the more recent "Inception."

The malware has the ability to essentially turn itself off and on according to the user’s work schedule and quietly peruse the computer for the information it seeks as if it’s wearing an invisibility cloak. Then it uses normal network “noise” to do its dirty work. It’s sophisticated and intriguing at the same time.

It does this by first looking at Twitter for some type of instruction, then follows whatever steps it is given. Then it looks to Github or other non-suspect services, and retrieves a normal looking image that actually includes code (called steganography) with additional instructions. When it finishes its tasks, it sends the information to a cloud server where the hackers can grab it. None of this would strike the IT group or security tools to suspect foul play.

It isn’t known at this time how the malware lands on particular machines, but it’s likely from phishing. So always be on the lookout for suspicious messages from unknown senders, or if the sender is known, don’t click on any attachments or links unless you are expecting them or you confirm that they are legitimate.

Since the motivation for this malware could be for spying, remember to keep sensitive information such as passwords and bank account numbers to yourself. Never write them out, especially if you have access to corporate accounts and even if the “IT Guy” asks you, don’t give him your passwords.  Also, be aware of social engineering, such as someone disguising themselves as pest control and asking for access to the computer room.

Some good news is that it’s likely this malware is targeting very specific people or organizations and has only been found on one organization’s network. However, it really isn’t known for certain what it’s up to. So be sure to maintain good security practices.