Agent.btz

  • First known sample

    2007

  • Discovery

    2008

  • Number of targets

    10000-300000

  • Current status

    Inactive since 2009

  • Type

    Worm

  • Targeted platforms

    Windows

  • TOP targeted countries

    Germany , Italy , Kazakhstan , Latvia , Lithuania , Poland , Russia , Spain , Ukraine , United Arab Emirates

  • Connected attacks

    Epic Turla

  • The way of propagation

    Self-replication , USB cables

  • Purpose/Functions

    Cyberespionage , Data wiping
  • Special features
    Ability to scan computers for data, open backdoors, and send data through those backdoors to a remote command and control server

  • Targets

    Diplomatic organizations/embassies , Military
  • Artefacts/Attribution
    Artifacts suggest Russian speaking malware authors
  • Description

    A worm that was originally discovered in 2007 when it was used to infect US military networks via an infected USB flash drive. It can scan computers for data and open backdoors through which to communicate with a remote command and control server. After copying itself from one USB flash drive to another, the worm then spread worldwide, with Russia leading the number of infections.

    Additional information

© 2024 AO Kaspersky Lab. All Rights Reserved. Privacy Policy Cookies
  1. Adding detection for known modules
  2. Collecting samples
  3. Reversing the samples
  4. Decrypting sophisticated encryption and compression schemes
  5. Understanding lateral movement
  6. Outlining multiple attack stages in the correct order
  7. Mapping C&C infrastructure
  8. Setting up sinkholes
  9. Analyzing collected traffic and communication protocols
  10. Crawling other hosts that understand the same protocol
  11. Taking down and acquiring images of C&C servers
  12. Identifying victims, sending out notifications to victims and global CERTs
  13. Applying forensic analysis and extracting logs, stolen files, other components
  14. Collecting and analyzing data from KSN, C&C servers, individual victims who are willing to work with us, sinkholes, crawlers, etc.
  15. Writing a comprehensive report
Read more
Mitigation is where enterprises need to start, prevention being significantly more effective and more cost-efficient than remediation after an attack Read more
For any inquiries, please contact apt.securelist@kaspersky.com If you are looking for more detailed information about an APT, please contact intelreports@kaspersky.com