The Anti-virus Times

Thursday, July 19, 2018

Doctor Web’s 2017 report on the presence of a vulnerability on Russia’s civil service website literally blew up the world’s online media outlets.

Meanwhile, the text of our announcement contained no references to viruses or malware being present on the portal.

What actually happened? And how dangerous was the incident?

To understand the situation, let's compare it with the MeDoc breach in Ukraine. At first glance, the incidents aren’t comparable: on the one hand, we have just an announcement with no infected computers, and on other hand, we have a real outbreak with a large number of infections. But that's only at first glance.

In reality, the incidents have a great deal in common:

• A backdoor that threat actors could exploit to deploy or remove malicious code (on the site or in the product update releases).
• The attackers remained inactive for quite some time after they deployed their backdoor.

So, the vulnerability that Doctor Web discovered back then was a backdoor that could potentially be used by threat actors to carry out their activities. The discovered code was not a Trojan or a virus, but it could perform malicious tasks whenever criminals needed it to. The Ukrainian company's infrastructure was infected in a similar fashion.

What did the attackers try to accomplish by deploying the code? Did they really want to use the backdoor to target multiple computers? We'll probably never know. But it could have happened at any moment.