VB2019 presentation: Attor: spy platform with curious GSM fingerprinting

Attor is a newly discovered cyber-espionage platform, use of which dates back to at least 2014 and which focuses on diplomatic missions and governmental institutions. The modular malware searches specifically for TrueCrypt‑protected hard drives and the processes of specific VPN applications, suggesting a special interest in security-focused users. The most notable plug-in is one that is able to detect connected GSM/GPRS modems or mobile devices, allowing Attor to speak to them directly using the AT command set.

Details of Attor were presented at VB2019 in London by ESET researcher Zuzana Hromcová. Shortly after her presentation, ESET also published a white paper containing many technical details.

Today we release the recording of Zuzana’s presentation.

Have you carried out research that furthers our understanding of the threat landscape? Have you discovered a technique that helps in the analysis of malware? The Call for Papers for VB2020 in Dublin is open! Submit your abstract before 15 March for a chance to make it onto the programme of one of the most international threat intelligence conferences.

outertext
https://www.virusbulletin.com/rss