Government organizations are being targeted by a new trojan called Netrepser that has infected more than 500 machines.

The malware is being used to gather intelligence such as system information, email and instant messaging passwords, session cookies and passwords from web browsers, and keystrokes.

“Paired with advanced spear phishing techniques and the malware’s primary focus to collect intelligence and exfiltrate it systematically, we presume that this attack is part of a high-level cyber-espionage campaign,” Bitdefender said in its report.

Netrepser depends on tools that are readily available such as a controversial recovery toolkit from Nirsoft. Nirsoft email and instant messaging password recovery tools are being used to gather email and IM passwords. Another Hirsoft ability is to steal passwords stored in browsers.

Other tools used include WinRAR and SDelete from Sysinternals. This allows the malware to compress stolen data before exfiltration as well as deleting files to protect recovery of forensic evidence.

Bitdefender has refrained from making any statement on attribution, however, it found that some file paths are written in Cyrillic script.

Source: Security Week