Hacker News Reader

Still missing details on how this qualifies as an APT, this seems nothing more than a basic trojan horse unless Kaspersky is for whatever reason neglecting to talk about whatever persistence mechanisms it has in place beyond the basics (startup entry of some form).

Malware explicitly targeting crypto software is scary regardless, however.

View on HN

The "persistent" in APT refers to the threat actor, not the tools themselves. So this is an APT because the threat actor has shown persistence by e.g. using multiple SWCs over a period of time and evolving their techniques. The individual tools used by the threat actor may not persist and in fact often don't, as APTs are much more likely to cover their tracks since they have a longer-term vision.

Not to mention they can reinfect via download and the malware scans the system[1] for:

- putty.exe

- filezilla.exe

- winscp.exe

- mstsc.exe

- mRemoteNG.exe

The malware also has the capabilities to fetch new instructions, so there's no telling what happens when any particular software is detected.

[1] https://securelist.com/blog/research/76147/on-the-strongpity... (linked in the first line of this thread's article)

Reply on news.ycombinator.com