Slovak company exposes malware operation targeting Russian firms

Slovak security company ESET has exposed an operation called Buhtrap, which is designed to target financial departments of Russian firms, the firm said Monday.

Following the successful infection of computers, an attacker is able to monitor the compromised device, install additional malware, monitor all activities conducted on the device while stealing information about smart cards if the computer in question is equipped with a smart card reader.

"We believe that this operation is financially motivated and its target is financial departments of Russian firms," Zuzana Hosalova from ESET said.

Cyber criminals are sending their victims e-mails containing malware-infested Word documents in attachments. The emails were either counterfeit invoices or contracts from Russian mobile phone operator MegaFon that tricked the victims into opening the files.

The malware in question took advantage of Word vulnerability that has been fixed three years ago.

"Once the malware was installed in the computer, cyber criminals used their access to infect other computers in the network and then pursue fraudulent banking transactions via these devices," added Hosalova. Endit