Grabit Espionage Campaign Steals Thousands of Files From SMBs
The Trojan steals about 10,000 files from smaller companies in Thailand, India and the U.S., showing that cyber-spying is no longer "just a 'big fish' game," Kaspersky says.From late February to mid-March, a group of attackers used a versatile piece of malware, dubbed Grabit by its authors, to infect computers and steal about 10,000 files from small and midsize businesses in Thailand, India and the United States. The malware, analyzed by security firm Kaspersky Lab, stole usernames and passwords from nearly 5,000 hosts, including for accounts on popular online mail systems such as Gmail and Yahoo as well as banking sites. The attackers have shown signs of erratic behavior, suggesting a group of mixed technical backgrounds, as some aspects of the attack show deep technical prowess while other parts demonstrate beginners' mistakes, Ido Naor, senior security researcher, Global Research & Analysis Team, Kaspersky Lab, stated in an analysis of the attack. Despite their learning curve, the attackers have had success: A keylogger associated with the attack stole more than 2,800 passwords, 1,000 emails and 3,000 usernames, according to data stored on a single command-and-control server and collected by Kaspersky Lab. "We see a lot of spying campaigns focused on enterprises, government organizations and other high-profile entities, with small and medium-sized businesses rarely seen in the lists of targets," Naor said in a statement sent to eWEEK. "But Grabit shows that it's not just a 'big fish' game—in the cyber world every single organization, whether it possesses money, information or political influence, could be of potential interest to one or other malicious actor."
Like attacks against larger companies, Grabit appears to be hitting high-value industries, such as agriculture, chemicals, construction, education, media and nanotechology. More than two-thirds of the files were taken from Thailand and India, with another 10 percent stolen from U.S. companies.