OnionDuke malware linked to MiniDuke hacker tools, which are thought to have been used to target Nato and European governments

This article is more than 5 years old

This article is more than 5 years old

A hacker who was surreptitiously injecting malicious code in downloads in to part of the Tor network has been linked to a series of government-sponsored cyber attacks.

Tor, also known as the Onion Router, allows internet users to access sites and services anonymously by routing encrypted traffic through a number of layers, known as relays, before a final jump to an exit node that leads to the open internet.

The attacker was abusing their control over one of those exit nodes in Russia to inject malware into downloads, Josh Pitts, a researcher at Leviathan Security, discovered in late October.

Finnish security firm F-Secure investigated the malware, calling it OnionDuke owing to its links to another piece of suite of hacker tools named MiniDuke, which is thought to have the backing of the Russian government as it had previously targeted Nato and European governments.

Once the OnionDuke malware was installed on a victim’s machine via a “wrapper” that included the original file and the malicious code, it would attempt to speak with its creators via a number of hacked websites.

Further malware would then be installed on the target machine, either via the same backdoor installed via Tor or other unknown means. One of the malware components connected to pre-registered domains to receive additional commands.

A number of those domains were the same as those used by the MiniDuke hackers, who surprised the security community earlier this year by simultaneously stealing data from drug dealers and government entities.

OnionDuke has been trying to pilfer login credentials amongst other system information from a range of targets, including European governments, F-Secure added in a blog post.

“We have also uncovered strong evidence suggesting that OnionDuke has been used in targeted attacks against European government agencies, although we have so far been unable to identify the infection vector(s),” wrote Artturi Lehtiö, a trainee at F-Secure.



Mikko Hypponnen, chief research officer at F-Secure, told the Guardian there were indications the attacks were linked to governments, but as with most suspected nation state incidents there was no proof.

“MiniDuke is believed to be linked to Russian governmental attack, although nobody has been able to prove this for a fact … we have no further information about linking this to Russian (or any other) government.”

The OnionDuke operators have been infecting files over Tor since at least since the end of October 2013, F-Secure said, and has been tampering with torrent downloads containing pirated software since February 2014.

Tor users who have updated to the latest version should be protected from the malicious Russian exit node as it has been blacklisted, but they might want to be wary of the 1,000 other exit nodes in the Tor network, some of which are believed to be under government control.

“The problem with Tor is that you have no idea who is maintaining the exit node you are using and what their motives are,” Lehtiö added.

Using a Virtual Private Network (VPN) will encrypt people’s traffic on the open web and hide users from such attackers.