Madi Trojan may be targeting UK firms

The recently unearthed Madi cyber campaign may be infecting governments and firms outside the Middle East including the UK, as those behind the attack add more pernicious capabilities, such as instant messaging monitoring.

Securlert, one of the two firms that helped discover Madi, has warned that infections are spreading far wider than initially estimated.

"Looking deeper into the Mahdi victims' IP addresses, we did find a few dozen IP addresses which seem to be from non-Middle Eastern countries, such as the US and UK," it warned on a company blog.

UK firms with significant business interests in the Middle East appeared at greater risks, it added. 

The Madi malware was originally believed to be mainly targeting groups and governments in the Middle East when it was first uncovered earlier in July. Symantec went so far as to warn that 72 per cent of Madi's victims are from Israel.

The news follows a warning from Kaspersky Lab that a new more dangerous form of Madi has emerged, with improved espionage powers that let's its authors monitor conversations, such as those on instant messaging system Jabber, or European social network, VKontakte.

Meanwhile, Securlert also reported discovering a possible link to the infamous Flame malware, reportedly finding an identifier prefix labelled "Flame" being used by Madi's command and control (C&C) server to communicate with infected machines.

"The first targeted victim with the "Flame" prefix began communicating with the C&C server in early June, right after the Kaspersky Lab discovery of Flame went public. Coincidence? Maybe," it added.

Madi was originally discovered on 17 July by Seculert and Kaspersky Lab. Madi is believed to have already stolen gigabytes of data from its victims' computers. The origin of the Trojan is currently unknown though vendors have hinted it may be the latest government funded cyber attack uncovered this year.

The UK government recently published a report claiming the country must instigate its own cyber weapons development programme if it wants to remain a world power.

• Tweet  
• Facebook  
•  
•  
• Save this article  
• Send to  

• Topics
• Security
• Operating Systems
• Privacy
• Symantec
• malware
• Government
• Kaspersky
• cyber-crime
• Hacking