StrongPity: Advanced Persistent Threat

Re:StrongPity: Advanced Persistent Threat by snuxoll on Monday October 10, 2016 @11:12AM (#12677494)

Still missing details on how this qualifies as an APT, this seems nothing more than a basic trojan horse unless Kaspersky is for whatever reason neglecting to talk about whatever persistence mechanisms it has in place beyond the basics (startup entry of some form).

Malware explicitly targeting crypto software is scary regardless, however.

[ Parent | on HN ]

Re:StrongPity: Advanced Persistent Threat by jcrawfordor on Monday October 10, 2016 @11:37AM (#12677679)

The "persistent" in APT refers to the threat actor, not the tools themselves. So this is an APT because the threat actor has shown persistence by e.g. using multiple SWCs over a period of time and evolving their techniques. The individual tools used by the threat actor may not persist and in fact often don't, as APTs are much more likely to cover their tracks since they have a longer-term vision.

[ Parent | on HN ]

Re:StrongPity: Advanced Persistent Threat by nerdy on Monday October 10, 2016 @11:48AM (#12677776)

Not to mention they can reinfect via download and the malware scans the system[1] for:

- putty.exe

- filezilla.exe

- winscp.exe

- mstsc.exe

- mRemoteNG.exe

The malware also has the capabilities to fetch new instructions, so there's no telling what happens when any particular software is detected.

[1] https://securelist.com/blog/research/76147/on-the-strongpity... (linked in the first line of this thread's article)

[ Parent | on HN ]