{"id":22855,"date":"2013-03-14T23:34:04","date_gmt":"2013-03-15T06:34:04","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=22855"},"modified":"2025-06-06T02:13:50","modified_gmt":"2025-06-06T09:13:50","slug":"travnet-trojan-could-be-part-of-apt-campaign","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/travnet-trojan-could-be-part-of-apt-campaign\/","title":{"rendered":"Travnet Trojan Could Be Part of APT Campaign"},"content":{"rendered":"

This blog post was written by Vikas Taneja.<\/em><\/p>\n

Attackers use all kinds of attack vectors to steal sensitive information from their targets. Their efforts are not limited to only zero-day vulnerabilities. Malware authors often exploit old vulnerabilities because a large number of organizations still use old vulnerable software. The Trojan Travnet, which steals information, is a classic example of malware that takes advantage of unpatched software. We have recently observed malicious Travnet RTF and Excel documents that exploit old vulnerabilities, such as CVE-2010-3333, in Microsoft Office. During our investigation we identified some samples associated with this campaign that have been active since 2009.<\/p>\n

Once Travnet infects a machine, it searches for all document files, such as PDF, PPT, and DOC, and uploads this data to remote servers. To evade detection from network-monitoring appliances such as intrusion detection and prevention systems, the malware sends the stolen data in encrypted format. To reduce the data size, it first uses a compression algorithm and then a Base64 algorithm.<\/p>\n

We have observed the following files actively used in this campaign:<\/h2>\n