Massively Distributed Citadel Malware Targets Middle Eastern Petrochemical Organizations

Recently, IBM Trusteer researchers identified targeted cyber attacks on several Middle Eastern petrochemical companies. They have identified a campaign in which attackers are using a variant of the evasive Citadel malware. Citadel was originally created for the purpose of stealing money from banks and has been massively distributed on users’ PCs around the world.

While the use of advanced malware that was originally built for financial theft as a generic advanced persistent threat (APT) tool is not new, this is the first time we’ve seen Citadel used to target nonfinancial organizations in a targeted/APT-style attack in order to potentially access corporate data, steal intellectual property or gain access to secured corporate resources, such as mail systems or remote access sites.

The targets of this attack include one of the largest sellers of petrochemical products in the Middle East and a regional supplier of raw petrochemical materials. We have worked to responsibly disclose this information to appropriate parties.

Read the white paper: Protecting Corporate Credentials against Today’s Threats

Citadel Malware Is Sophisticated, Evasive

The Citadel malware was first discovered in 2012. Back then, it was a man-in-the-browser malware designed to steal banking credentials using webinjects. Since then, malware developers have significantly extended its functionality. Today, it offers a wide range of powerful functions to steal information and remotely manage infected computers. The malware operates according to instructions provided in a configuration file. Once Citadel is installed on a machine, it fetches a configuration file from one of its command-and-control servers. The configuration file instructs Citadel on which websites and applications to target, which information to steal and how to steal it.

According to an analysis of the configuration file used in this attack, the Citadel malware was instructed to look for user access to certain URL addresses of Internet-connected systems, such as webmail, of the targeted companies. Once the browser accesses such a URL, the malware is instructed to grab all the information submitted by the user. This is known as form grabbing, or “HTTP POST” grabbing. When the user submits information into the system, the Web browser generates an HTTP POST request that sends the data entered to the site. The malware then intercepts the POST data before it is encrypted and sent to the server.

Below is the relevant section from the configuration file (shown in a Trusteer proprietary format), with the names of the targeted companies redacted:

The targets are listed in the Citadel configuration file

To steal login credentials that provide access to the company’s webmail system, the malware looks for URLs like “http://mail.target-company.com,” which would be the login URL of the webmail system. When the user submits the login credentials, the malware grabs the username, password and any other information that is submitted during the login process. The information is sent to the cyber criminal, who can then log in on behalf of a trusted user, access corporate emails, send malicious emails and more.

Example of a webmail system login page

Massively Distributed APT Malware

This is not the first time massively distributed malware originally designed for financial fraud has been used to target nonfinancial organizations in an APT-style attack. In fact, we wrote an article on this back in 2010. Citadel is one of many dozens of malware families that were initially created to steal money from financial targets, such as banks. These include the infamous Zeus, SpyEye and Shylock families. Over time, malware developers extended the capabilities of these malware families and added advanced evasion techniques to turn them into sophisticated APT tools that can target organizations in general.

The typical functions available with these malware families include:

  • Keylogging: Recording the user keystrokes and sending them to the attacker.
  • Screenshot capturing: Recording the browser session, including all the information that is displayed to the user.
  • Video capturing: Recording a video stream of a browser session, including all the information that is displayed to the user.
  • Form grabbing (HTTP POST grabbing): A method used to acquire user input from a Web data form before it is sent to the user. HTTP POST grabbing has multiple advantages compared to other information-stealing methods such as keylogging and screenshot capturing. Capturing the data in the form just before it is sent to the server enables the attacker to capture the real, complete data the user entered, even if the user entered it using a virtual keyboard or copied and pasted it into the browser.
  • HTML injection: A method used to inject HTML content into a legitimate Web page in order to modify it and steal information from the user. It is often used to display fake security warnings and customized text requesting additional information during login, account navigation and financial transactions.
  • Remote execution of command line instructions: Enables the operator to collect data and change settings on one or more remote computers.
  • Remote control of the infected machine: Allows complete control over the PC and full access to the corporate network. It is typically done via a graphical, desktop-sharing system that is used to remotely control another computer, such as virtual network computing tools.
  • Advanced evasion techniques: Designed to evade antivirus and other traditional security controls.
  • Anti-research techniques: A variety of sophisticated features designed to thwart malware researchers from analyzing the malware and understanding its internal operations or attack methods.

Although the trend of using such malware for APT-style attacks has been seen for a few years now, many are still not aware of it. APTs are still referred to as highly targeted attacks that utilize custom tools specifically designed to target an organization or a group of organizations.

The use of massively distributed malware means that attackers don’t need to spear-phish targets or design custom malware. Instead, they use mass distribution techniques to infect as many PCs as possible. These malware distribution campaigns can use malicious email attachments, drive-by downloads, watering hole attacks and social engineering schemes to infect millions of PCs around the world.

IBM Trusteer research found that an average of 1 in 500 machines worldwide is infected with massively distributed APT malware at any point in time. IBM Trusteer’s Service team reports that they have discovered such malware in practically every customer environment in which they’ve worked.

The graphs below, based on IBM Trusteer research, show a heat map of massively distributed APT malware infection rates per country:

Infection rates for massively distributed APT malware by country

Protecting Against Massively Distributed APTs

IBM Trusteer Endpoint Protection solutions are designed to provide extensive protection against massively distributed APT malware families, including Citadel, Zeus, SpyEye and Shylock. These solutions can detect, mitigate and remediate massively distributed APT malware infections. Moreover, they can stop future infections and prevent endpoint compromise by applying integrated, multilayered defenses that break the threat life cycle. Deploying a solution can help enterprise organizations deal with massively distributed APT attacks and emerging threats.

IBM Trusteer threat research is based on dynamic intelligence feeding from more than 100 million protected endpoints and translated into security updates that are automatically sent to protected endpoints.

Deployments of IBM Trusteer Endpoint Protection solutions are backed by Trusteer’s security services, which can help enterprise organizations deal with massively distributed APT attacks and emerging threats.

Share this Article:
Dana Tamir

Director of Enterprise Security at Trusteer, an IBM Company

Dana Tamir is Director of Enterprise Security at Trusteer, an IBM Company. In her role she leads activities related to enterprise advanced threat protection solutions. With over a decade of real-world expertise in the security Industry, she routinely delivers advanced threat and security related presentations, blogs, articles, white papers and webcasts. Prior to joining Trusteer, Dana held various roles at leading security companies including Imperva, Symantec, Bindview, and Amdocs. Dana holds an engineering degree from the Technion – Israel Institute of Technology, in addition to a number of industry and vendor certifications.