Woburn, MA – October 3, 2019 – Kaspersky researchers have discovered new malware that hijacks victims’ interactions with HTTPS web pages by patching the pseudo random number generator used in establishing an encrypted connection. It gives actors the ability to spy on users’ browser activity, as well as to install rogue digital certificates.

While the “S” in HTTPS stands for “Secure” and implies that information exchanged between a browser and a website is not accessible to third parties, there still are many ways for a skilled, high-profile hacking group to interfere in this process. Reductor is a tool developed for such intrusion and was used for cyber espionage on diplomatic entities in CIS countries, primarily by monitoring their employees’ internet traffic. The found modules had RAT (Remote Administration Tool) functions and the malware’s capabilities were almost unlimited.

Reductor distributors had two main attack vectors, one of which consisted of downloading modules through COMPfun malware, previously attributed to the Turla Russian-speaking threat actor. Another vector was trickier: apparently the attacker had the ability to patch clean software on the fly while it was being downloaded from legitimate websites to users’ computers. The software installers came from the warez websites, which offer free downloads of pirated software. While the original installers available on those websites were not infected, they would end up on the victims’ PCs carrying malware. Kaspersky researchers concluded that replacement happens on the fly and that Reductor’s operators have some control over the target’s network channel.

Once Reductor found its way to the victim’s device, it would manipulate installed digital certificates, patching browsers’ pseudo random number generators used to encrypt the traffic coming from the user to HTTPS websites. To identify victims whose traffic is hijacked, the criminals would add unique hardware and software-based identifiers for each and mark them with certain numbers in a not-so-random numbers generator. Once the browser on the infected device is patched, the threat actor receives all information and actions performed with this browser, while the victim remains unsuspecting of anything untoward.

“We haven’t seen malware developers interacting with browser encryption in this way before,” said Kurt Baumgartner, security researcher at Kaspersky’s Global Research and Analysis Team. “It is elegant in a way and allowed attackers to stay well under the radar for a long time. The level of sophistication of the attack method suggests that the creators of Reductor malware are highly professional, which is quite common among nation-state backed actors. However, we weren’t able to find solid technical clues which would attach this malware to any known threat actor. We urge all organizations dealing with sensitive data to stay alert and have regular, thorough security checks.”

Kaspersky products successfully detect and block Reductor malware.

More information about the new malware can be found on Securelist.com.