Windows 10: InvisiMole spyware turns affected computer into video camera

Brink · Jun 11, 2018

This is the modus operandi of the two malicious components of InvisiMole. They turn the affected computer into a video camera, letting the attackers see and hear what’s going on in the victim’s office or wherever their device may be. Uninvited, InvisiMole’s operators access the system, closely monitoring the victim’s activities and stealing the victim’s secrets.

Our telemetry indicates that the malicious actors behind this malware have been active at least since 2013, yet the cyber-espionage tool was never analyzed nor detected until discovered by ESET products on compromised computers in Ukraine and Russia.

The campaign is highly targeted – no wonder the malware has a low infection ratio, with only a few dozen computers being affected.

InvisiMole has a modular architecture, starting its journey with a wrapper DLL, and performing its activities using two other modules that are embedded in its resources. Both of the modules are feature-rich backdoors, which together give it the ability to gather as much information about the target as possible.

Extra measures are taken to avoid attracting the attention of the compromised user, enabling the malware to reside on the system for a longer period of time. How the spyware was spread to the infected machines is yet to be determined by further investigation. All infection vectors are possible, including installation facilitated by physical access to the machine...

Conclusion

InvisiMole is fully-equipped spyware whose rich capabilities can surely compete with other espionage tools seen in the wild.

We can only wonder why the authors decided to use two modules with overlapping capabilities. One might think the smaller module, RC2FM, is used as an initial reconnaissance tool, while the bigger RC2CL module is only run on interesting targets. This is, however, not the case – both of the modules are launched simultaneously. Another possible explanation is that the modules might have been crafted by various authors and then bundled together to provide the malware operators a more complex range of functionalities.

The malware uses only a few techniques to avoid detection and analysis, yet, deployed against a very small number of high-value targets, it was able to stay under the radar for at least five years....
Click to expand...

Read more: InvisiMole spyware hunting for secrets while staying deep in the shadows

See also: malware-ioc/invisimole at master - eset/malware-ioc - GitHub

:)

PhyllisScheffler · Jun 11, 2018

Turning on spyware and virus protection

I have Windows 10 and have been advised that both my spyware and virus protections are not turned on. I have tried to turn them on but to no avail. I do not have any competing protection installed on my computer. Please advise as to how to proceed.

Gina_on_the_thread · Jun 11, 2018

camera not working

If you have the camera connected to the computer, I would suggest that you disconnect the camera and then try to open the Camera app.

If the camera app opens, follow the steps below:

Press “Windows key + C” from your keyboard to open “Charms bar”.

Select “Settings” option.

Select “Permissions” option.

Turn on “Allow this app to access your: Webcam and Microphone” option.

Lose the app by pressing “Alt key + F4” from your keyboard.

Reopen the Camera app.

Connect your camera and then check how this app works.

Goodluck!

Windows 10: InvisiMole spyware turns affected computer into video camera

InvisiMole spyware turns affected computer into video camera

InvisiMole spyware turns affected computer into video camera

InvisiMole spyware turns affected computer into video camera - Similar Threads - InvisiMole spyware turns

computer cant find camera, camera is turned on and this is a laptop

computer cant find camera, camera is turned on and this is a laptop

my computer keeps video camera

my computer keeps video camera

Camera Doesn't Turn Off After Video Calls

Camera - Video

Camera turns black when I switch from camera to video

my computer has spyware

my computer has spyware