NetTraveler orTravNet isspyware that dates from 2004 and that has been actively used at least until 2016, infecting hundreds of often high-profile servers in dozens of countries.[1]
The name of this malware is based on the fact that early versions of it contained the string "NetTraveler is Running!". It is used by attackers foradvanced persistent threats to survey their victims. It can transfer large amounts of private information from systems of victims toC&C servers, functioning as atrojan horse and backdoor to these systems.[2][3]
Spear-phishing with Office documents like MS Word documents is used to infect vulnerable systems, targeting theCVE-2012-0158 and CVE-2010-3333 vulnerabilities.[2] The attackers use news articles that are relevant to their targets for their spear fishing.[1]
Kaspersky Lab found that certain victims that were infected with NetTraveler were also infected byRed October, although no direct relation with this malware was established. The multiple infections might be accounted for by the fact that these were high-profile victims like government agencies, nuclear power installations and embassies in dozens of countries.[4]
Command and Control servers that were involved in NetTraveler attacks were located in theUnited States,Hong Kong andChina, which used more than 100 URLs. These C&C servers mostly ran IIS 6/7.
According to Kaspersky Lab, NetTraveler isused by a medium-sized threat actor group from China.
There are several ways to get rid of NetTraveler on an infected system, like withVirus Removal Tools and the SpyHunter Removal Tool. It is also possible to remove this malware manually.[3]
Specially targeted countries included Russia, India, Pakistan, Mongolia, Kyrgyzstan and Kazakhstan.[5]