October 12, 2018 By David Bisson 2 min read

Researchers uncovered a malware sample called iTranslator that installs two drivers onto an infected machine to perform a man-in-the-middle (MitM) attack.

According to FortiGuard Labs, the malware sample, called itranslator_02.exe, is signed by a digital certificate that expired back in 2015.

This instance starts off by creating a folder called “itranslator” in the program-data folder and extracting a file named wintrans.exe into that folder. The file initializes by installing iTranslatorSvc, a driver that enables the malware to load at system startup. Next, wintrans.exe installs another driver called “iNetfilterSvc” before downloading “iTranslator.dll.”

This dynamic link library (DLL) acts as the main malware module. It installs a secure sockets layer (SSL) certificate into web browsers as trusted root certificates without the victim’s permission, communicates with the two drivers iNetfilterSvc and iTranslatorSvc, and monitors the internet access packets from a victim’s web browsers. These functions support iTranslator’s performance of a MitM attack on a compromised system, thereby empowering the attackers to steal sensitive information.

What Are the Elements of a MitM Attack?

As noted by Incapsula, a successful MitM attack consists of two elements: the interception of user traffic before it reaches its destination and the decryption of SSL traffic without alerting the user. Bad actors have several methods, such as IP spoofing and SSL hijacking, that allow them to fulfill both of these stages.

Online criminals are also embedding these tactics into different kinds of threats. Kaspersky Lab researchers noted that they discovered MitM capabilities in malicious Google Chrome extensions. According to Cisco Talos, meanwhile, the advanced Internet of Things (IoT) botnet malware VPNFilter also had a module for conducting MitM attacks.

How to Protect Against Malware Like iTranslator

For computers infected with iTranslator, FortiGuard Labs advised security professionals to delete the files and folders created by the malware. In general, organizations can defend themselves against MitM attacks by implementing a layered defense strategy that combines traditional, file-based security with machine learning, threat detection sandboxing and next-generation endpoint protection.

Sources: FortiGuard Labs, Incapsula, Securelist, Cisco Talos

More from

CISA releases landmark cyber incident reporting proposal

2 min read - Due to ongoing cyberattacks and threats, critical infrastructure organizations have been on high alert. Now, the Cybersecurity and Infrastructure Security Agency (CISA) has introduced a draft of landmark regulation outlining how organizations will be required to report cyber incidents to the federal government.The 447-page Notice of Proposed Rulemaking (NPRM) has been released and is open for public feedback through the Federal Register. CISA was required to develop this report by the Cyber Incident Reporting for Critical Infrastructure Act of 2022…

Ransomware payouts hit all-time high, but that’s not the whole story

3 min read - Ransomware payments hit an all-time high of $1.1 billion in 2023, following a steep drop in total payouts in 2022. Some factors that may have contributed to the decline in 2022 were the Ukraine conflict, fewer victims paying ransoms and cyber group takedowns by legal authorities.In 2023, however, ransomware payouts came roaring back to set a new all-time record. During 2023, nefarious actors targeted high-profile institutions and critical infrastructure, including hospitals, schools and government agencies.Still, it’s not all roses for…

What should an AI ethics governance framework look like?

4 min read - While the race to achieve generative AI intensifies, the ethical debate surrounding the technology also continues to heat up. And the stakes keep getting higher.As per Gartner, “Organizations are responsible for ensuring that AI projects they develop, deploy or use do not have negative ethical consequences.” Meanwhile, 79% of executives say AI ethics is important to their enterprise-wide AI approach, but less than 25% have operationalized ethics governance principles.AI is also high on the list of United States government concerns.…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today