Project Sauron

Two years ago cyber intel found weird traffic on some government organisation. Malware code loaded itself to memory on windows domain controller environment. Code registered as polity filter and had access to sensitive data as password in clear text.

They called project Sauron derived from lord of the rings series fan-fiction that code include itself to ‘Sauron’ in configuration files. According to cyber intels souron commands top of the cyber espionage platform designed for very complex design coupled with several exfiltration medhots. In terms of general APT efforts have a geographical nexus or targeted victim, aimed at extracting information with specific purposes. Interestingly, Sauron seems to be dedicated to just a few countries, focused on collecting high value intels.

One install sauron itself modules start working as sleeper cells displaying no activity of their own and waiting for wake up signal from incoming traffic. It designed to work as backdoor, downloading new modules and running command from attacker purely in memory. Only way to detect to make full memory dump of infecting systems. The modules are purpose based designed to steal documents, recording key strokes, intercepting encryption keys and so on.

Another interesting factor is that their malware form completely polymorphic, they have different filenames and sizes and generally individually built for specific targets. Every modules has uniquely different timestamps. They implements to using its own virtual file system to store plugins and modified LUA interpreter to execute their scripts. Generally counts 50 different modules design for mostly windows environment.

It seems to be sauron is extremely well prepared when it comes to operation. Running with lots of domain and server infrastructure uniquely assigned to each victim organization and never again reused. Analysis collects 28 domains linked to 11 IPs located in the United States and several European countries that might be connected to Sauron campaigns.

Every APT analysis brings awesome knowledge of design, Sauron is a very advanced actor we only compare to top APT(s) in terms of sophistication alongside with duqu, flame, equation etc.