Sednit

Sednit is a dangerous backdoor Trojan which is distributed over the Internet via spear-phishing emails. The Sednit malware has targeted military, media, governments, and other authoritative institutions around the world. The backdoor Trojan is executed when the email receiver downloads a .doc attachment containing information about the latest political events in the world. For example, in one of the scam emails, the email receiver is provided with information about NATO’s view on the conflict in Ukraine. Moreover, Sednit spreads with the help of certain legitimate websites. The attackers insert an iframe into a website, resulting in the visitor’s redirection to an illegal website which features certain exploit kits. A third attack vector deals with phishing websites. Victims are led to websites that resemble legitimate websites,enabling the attackers to collect victims’ credentials.

As regards exploit kits, it has been found that the Sednit malware has targeted Internet Explorer (versions 8 and 10). More specifically, there are three exploits dealing with the following vulnerabilities of the Internet browser: CVE-2013-1347, CVE-213-3897, CVE-2014-1776. The latter one has not been seen in any other popular exploit kits.

As mentioned above, the Sednit malware is a backdoor Trojan, which means that it is essential in this attack. The infection communicates with remote attackers, receive commands, and collects and sends the collected data to the attackers.

In order to prevent data loss and other issues, governmental and other institutions should pay more attention to their online security. Moreover, this attack operation should encourage administrators to implement some preventive measures.

If you receive an email letter from an unknown sender, you should delete it immediately. Phishing emails are one of the means of online deception, and, if you do not want to struggle to remove malware from your operating system at some point in the future, you should develop new Internet usage habits in order to prevent serious consequences.

The Sednit malware, also known as Trojan:Win32/Foosace.A, should be removed from the compromised system immediately. The same goes for many other data-stealing Trojan horses that get into the computer in a variety of ways.

If you want to be secure on the Internet and be sure that your personal data is protected, you should use a reputable security program. Our team recommends using SpyHunter, which is a real-time security program that successfully tackles Trojan horses, ransomware infections, adware, browser hijackers, rogue anti-virus programs, and many other spyware and malware threats.