Security researchers from Trend Micro have discovered a new malware they have dubbed “BLYPT.” The malware’s primary targets are internet users from the United States. That doesn’t mean it can’t also make its way to Greece, as the internet knows no borders. So far, the security firm has discovered three different variants of it ( BKDR_BLYPT.A, BKDR_BLYPT.B , and BKDR64_BLYPT.B ).
According to experts, the Java exploits used by BLYPT come via downloads and “tricked” websites. The exploits use CVE-2013-1493, a vulnerability that was supposedly patched by Oracle in March.
The exploit downloads an installer that downloads and installs the main BLYPT named logo32.png or logo64.png depending on the victim's operating system.
Once it infects a computer, the malware allows the hackers behind it to send various commands to the compromised system. These commands include downloading a malicious DLL, new settings, and HTTP request commands.
The command and control (C&C) centers are located on servers in Romania and Turkey. Some servers have also been detected in China and the United States.
Additional technical details about BLYPT are available on the Trend Micro.
