{"id":14227,"date":"2020-05-14T16:10:37","date_gmt":"2020-05-14T08:10:37","guid":{"rendered":"https:\/\/version-2.com\/?p=14227"},"modified":"2020-11-04T13:23:12","modified_gmt":"2020-11-04T05:23:12","slug":"deconstructing-mikroceen-researchers-uncover-spying-backdoor-attacking-high-profile-targets-in-central-asia","status":"publish","type":"post","link":"https:\/\/version-2.com\/en\/2020\/05\/deconstructing-mikroceen-researchers-uncover-spying-backdoor-attacking-high-profile-targets-in-central-asia\/","title":{"rendered":"Deconstructing Mikroceen: Researchers uncover spying backdoor attacking high-profile targets in Central Asia"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/p>\n

The analysis is the result of joint research between ESET and Avast
<\/strong>
BRATISLAVA, PRAGUE<\/strong>\u00a0\u2013 ESET recently teamed up with Avast to research a widespread and constantly evolving remote access tool (RAT) with the usual backdoor functionality that ESET has dubbed Mikroceen. In the joint analysis, the researchers uncovered Mikroceen being used in espionage attacks against government and business entities (from the telecommunications and gas industries) in Central Asia.<\/p>\n

<\/p>\n

<\/p>\n

The attackers were able to gain long-term access to affected networks, manipulate files and take screenshots. Victims\u2019 devices could execute various commands delivered remotely from command and control servers.<\/p>\n

<\/p>\n

<\/p>\n

The researchers investigated the custom implementation of Mikroceen\u2019s client-server model, purpose-built for cyberespionage. \u201cThe malware developers put great effort in securing the client-server connection with their victims. Their malware was leveraged \u2018in the wild,\u2019 as the operators managed to penetrate high-profile corporate networks. We also saw a larger attack toolset being used and constantly developed, which consisted mainly of variations in obfuscation techniques,\u201d comments Peter K\u00e1lnai, who led the ESET arm of the joint research team.<\/p>\n

<\/p>\n

<\/p>\n

Mikroceen is under constant development, and security researchers have seen it used with backdoor capabilities in various targeted operations since late 2017. Among the tools used by the attackers to move within the infiltrated networks, ESET and Avast researchers also identified Gh0st RAT, an older, yet infamous, RAT created around 2008. There are many similarities between Gh0st RAT and Mikroceen, with the main shift between the projects in securing the connection with a certificate.<\/p>\n

<\/p>\n

<\/p>\n

For more technical details about Mikroceen, read the blog post\u00a0Mikroceen: Spying backdoor leveraged in high profile networks in Central Asia<\/a>\u00a0on WeLiveSecurity. Make sure to follow\u00a0ESET Research on Twitter<\/a>\u00a0for the latest news from ESET Research.<\/p>\n

<\/p>\n

<\/p>\n

\u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

About Version 2 Digital<\/h3>

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.\n

\nThrough an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t\n\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

About ESET<\/strong>
For 30 years, ESET\u00ae has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET\u2019s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24\/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single \u201cin-the-wild\u201d malware without interruption since 2003.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"

The analysis is the result of joint research between ES […]<\/p>","protected":false},"author":143524195,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[40,61,99],"tags":[289,290,41,98],"class_list":["post-14227","post","type-post","status-publish","format-standard","hentry","category-eset","category-press-release","category-year2020","tag-spy","tag-backdoor","tag-eset","tag-98"],"acf":[],"yoast_head":"\nDeconstructing Mikroceen: Researchers uncover spying backdoor attacking high-profile targets in Central Asia - Version 2<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/version-2.com\/en\/2020\/05\/deconstructing-mikroceen-researchers-uncover-spying-backdoor-attacking-high-profile-targets-in-central-asia\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Deconstructing Mikroceen: Researchers uncover spying backdoor attacking high-profile targets in Central Asia - Version 2\" \/>\n<meta property=\"og:description\" content=\"The analysis is the result of joint research between ES […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/version-2.com\/en\/2020\/05\/deconstructing-mikroceen-researchers-uncover-spying-backdoor-attacking-high-profile-targets-in-central-asia\/\" \/>\n<meta property=\"og:site_name\" content=\"Version 2\" \/>\n<meta property=\"article:published_time\" content=\"2020-05-14T08:10:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-11-04T05:23:12+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/version-2.com\/wp-content\/uploads\/2020\/04\/blog-v2-logo.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"250\" \/>\n\t<meta property=\"og:image:height\" content=\"70\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"version2hk\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"version2hk\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/version-2.com\\\/2020\\\/05\\\/deconstructing-mikroceen-researchers-uncover-spying-backdoor-attacking-high-profile-targets-in-central-asia\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/2020\\\/05\\\/deconstructing-mikroceen-researchers-uncover-spying-backdoor-attacking-high-profile-targets-in-central-asia\\\/\"},\"author\":{\"name\":\"version2hk\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/person\\\/d14d2d3cd77ffdb618b9f1330fe084db\"},\"headline\":\"Deconstructing Mikroceen: Researchers uncover spying backdoor attacking high-profile targets in Central Asia\",\"datePublished\":\"2020-05-14T08:10:37+00:00\",\"dateModified\":\"2020-11-04T05:23:12+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/2020\\\/05\\\/deconstructing-mikroceen-researchers-uncover-spying-backdoor-attacking-high-profile-targets-in-central-asia\\\/\"},\"wordCount\":303,\"publisher\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\"},\"keywords\":[\"spy\",\"backdoor\",\"ESET\",\"2020\"],\"articleSection\":[\"ESET\",\"Press Release\",\"2020\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/version-2.com\\\/2020\\\/05\\\/deconstructing-mikroceen-researchers-uncover-spying-backdoor-attacking-high-profile-targets-in-central-asia\\\/\",\"url\":\"https:\\\/\\\/version-2.com\\\/2020\\\/05\\\/deconstructing-mikroceen-researchers-uncover-spying-backdoor-attacking-high-profile-targets-in-central-asia\\\/\",\"name\":\"Deconstructing Mikroceen: Researchers uncover spying backdoor attacking high-profile targets in Central Asia - Version 2\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#website\"},\"datePublished\":\"2020-05-14T08:10:37+00:00\",\"dateModified\":\"2020-11-04T05:23:12+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/2020\\\/05\\\/deconstructing-mikroceen-researchers-uncover-spying-backdoor-attacking-high-profile-targets-in-central-asia\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/version-2.com\\\/2020\\\/05\\\/deconstructing-mikroceen-researchers-uncover-spying-backdoor-attacking-high-profile-targets-in-central-asia\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/version-2.com\\\/2020\\\/05\\\/deconstructing-mikroceen-researchers-uncover-spying-backdoor-attacking-high-profile-targets-in-central-asia\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9801\",\"item\":\"https:\\\/\\\/version-2.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Deconstructing Mikroceen: Researchers uncover spying backdoor attacking high-profile targets in Central Asia\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#website\",\"url\":\"https:\\\/\\\/version-2.com\\\/zh\\\/\",\"name\":\"Version 2\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/version-2.com\\\/zh\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\",\"name\":\"Version 2\",\"url\":\"https:\\\/\\\/version-2.com\\\/zh\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/version-2.com\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/version-2.com\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1\",\"width\":1795,\"height\":335,\"caption\":\"Version 2\"},\"image\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/person\\\/d14d2d3cd77ffdb618b9f1330fe084db\",\"name\":\"version2hk\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g\",\"caption\":\"version2hk\"},\"sameAs\":[\"http:\\\/\\\/version2xfortcom.wordpress.com\"],\"url\":\"https:\\\/\\\/version-2.com\\\/en\\\/author\\\/version2hk\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Deconstructing Mikroceen: Researchers uncover spying backdoor attacking high-profile targets in Central Asia - Version 2","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/version-2.com\/en\/2020\/05\/deconstructing-mikroceen-researchers-uncover-spying-backdoor-attacking-high-profile-targets-in-central-asia\/","og_locale":"en_US","og_type":"article","og_title":"Deconstructing Mikroceen: Researchers uncover spying backdoor attacking high-profile targets in Central Asia - Version 2","og_description":"The analysis is the result of joint research between ES […]","og_url":"https:\/\/version-2.com\/en\/2020\/05\/deconstructing-mikroceen-researchers-uncover-spying-backdoor-attacking-high-profile-targets-in-central-asia\/","og_site_name":"Version 2","article_published_time":"2020-05-14T08:10:37+00:00","article_modified_time":"2020-11-04T05:23:12+00:00","og_image":[{"width":250,"height":70,"url":"https:\/\/version-2.com\/wp-content\/uploads\/2020\/04\/blog-v2-logo.jpg","type":"image\/jpeg"}],"author":"version2hk","twitter_card":"summary_large_image","twitter_misc":{"Written by":"version2hk","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/version-2.com\/2020\/05\/deconstructing-mikroceen-researchers-uncover-spying-backdoor-attacking-high-profile-targets-in-central-asia\/#article","isPartOf":{"@id":"https:\/\/version-2.com\/2020\/05\/deconstructing-mikroceen-researchers-uncover-spying-backdoor-attacking-high-profile-targets-in-central-asia\/"},"author":{"name":"version2hk","@id":"https:\/\/version-2.com\/zh\/#\/schema\/person\/d14d2d3cd77ffdb618b9f1330fe084db"},"headline":"Deconstructing Mikroceen: Researchers uncover spying backdoor attacking high-profile targets in Central Asia","datePublished":"2020-05-14T08:10:37+00:00","dateModified":"2020-11-04T05:23:12+00:00","mainEntityOfPage":{"@id":"https:\/\/version-2.com\/2020\/05\/deconstructing-mikroceen-researchers-uncover-spying-backdoor-attacking-high-profile-targets-in-central-asia\/"},"wordCount":303,"publisher":{"@id":"https:\/\/version-2.com\/zh\/#organization"},"keywords":["spy","backdoor","ESET","2020"],"articleSection":["ESET","Press Release","2020"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/version-2.com\/2020\/05\/deconstructing-mikroceen-researchers-uncover-spying-backdoor-attacking-high-profile-targets-in-central-asia\/","url":"https:\/\/version-2.com\/2020\/05\/deconstructing-mikroceen-researchers-uncover-spying-backdoor-attacking-high-profile-targets-in-central-asia\/","name":"Deconstructing Mikroceen: Researchers uncover spying backdoor attacking high-profile targets in Central Asia - Version 2","isPartOf":{"@id":"https:\/\/version-2.com\/zh\/#website"},"datePublished":"2020-05-14T08:10:37+00:00","dateModified":"2020-11-04T05:23:12+00:00","breadcrumb":{"@id":"https:\/\/version-2.com\/2020\/05\/deconstructing-mikroceen-researchers-uncover-spying-backdoor-attacking-high-profile-targets-in-central-asia\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/version-2.com\/2020\/05\/deconstructing-mikroceen-researchers-uncover-spying-backdoor-attacking-high-profile-targets-in-central-asia\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/version-2.com\/2020\/05\/deconstructing-mikroceen-researchers-uncover-spying-backdoor-attacking-high-profile-targets-in-central-asia\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9801","item":"https:\/\/version-2.com\/"},{"@type":"ListItem","position":2,"name":"Deconstructing Mikroceen: Researchers uncover spying backdoor attacking high-profile targets in Central Asia"}]},{"@type":"WebSite","@id":"https:\/\/version-2.com\/zh\/#website","url":"https:\/\/version-2.com\/zh\/","name":"Version 2","description":"","publisher":{"@id":"https:\/\/version-2.com\/zh\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/version-2.com\/zh\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/version-2.com\/zh\/#organization","name":"Version 2","url":"https:\/\/version-2.com\/zh\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/version-2.com\/zh\/#\/schema\/logo\/image\/","url":"https:\/\/i0.wp.com\/version-2.com\/wp-content\/uploads\/2020\/08\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1","contentUrl":"https:\/\/i0.wp.com\/version-2.com\/wp-content\/uploads\/2020\/08\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1","width":1795,"height":335,"caption":"Version 2"},"image":{"@id":"https:\/\/version-2.com\/zh\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/version-2.com\/zh\/#\/schema\/person\/d14d2d3cd77ffdb618b9f1330fe084db","name":"version2hk","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g","caption":"version2hk"},"sameAs":["http:\/\/version2xfortcom.wordpress.com"],"url":"https:\/\/version-2.com\/en\/author\/version2hk\/"}]}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/pbQRKm-3Ht","post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts\/14227","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/users\/143524195"}],"replies":[{"embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/comments?post=14227"}],"version-history":[{"count":5,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts\/14227\/revisions"}],"predecessor-version":[{"id":20051,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts\/14227\/revisions\/20051"}],"wp:attachment":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/media?parent=14227"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/categories?post=14227"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/tags?post=14227"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}