Ajay Kumar: Created a new article

2023-09-25T18:43:55Z

Created a new article

New page

{{Short description|Computer spyware}}
'''NetTraveler''' or '''TravNet''' is [[spyware]] that dates from 2004 and that has been actively used at least until 2016, infecting hundreds of often high-profile servers in dozens of countries.<ref name=Proofpoint>{{cite web |url=https://www.proofpoint.com/us/threat-insight/post/nettraveler-apt-targets-russian-european-interests |title=NetTraveler APT Targets Russian, European Interests |publisher=Proofpoint |date=July 7, 2016 |url-status=live |archive-url=https://web.archive.org/web/20170423022624/https://www.proofpoint.com/us/threat-insight/post/nettraveler-apt-targets-russian-european-interests |archive-date=April 23, 2017}}</ref>

The name of this malware is based on the fact that early versions of it contained the string "NetTraveler is Running!". It is used by attackers for [[advanced persistent threat]]s to survey their victims. It can transfer large amounts of private information from systems of victims to [[Botnet#Command_and_control|C&C]] servers, functioning as a [[Trojan horse (computing)|trojan horse]] and backdoor to these systems.<ref name=Kaspersky>{{cite web |url=https://kasperskycontenthub.com/wp-content/uploads/sites/43/vlpdfs/kaspersky-the-net-traveler-part1-final.pdf |title=The NetTraveler (a.k.a. 'Travnet') |publisher=Kaspersky Lab |url-status=live |archive-url=https://web.archive.org/web/20171116223849/http://kasperskycontenthub.com/wp-content/uploads/sites/43/vlpdfs/kaspersky-the-net-traveler-part1-final.pdf |archive-date=November 16, 2017 }}</ref><ref name=PC-Remover>{{cite web |url=http://pc-remover.com/post/How-to-Remove-NetTraveler-Completely-From-Your-PC_14_159965.html |title=How to Remove NetTraveler Completely From Your PC? |website=pc-remover.com |url-status=dead |archive-url=https://www.webcitation.org/6rhMbzwjD?url=http://pc-remover.com/post/How-to-Remove-NetTraveler-Completely-From-Your-PC_14_159965.html |archive-date=July 4, 2017}}</ref>

[[Spear-phishing]] with Office documents like MS Word documents is used to infect vulnerable systems, targeting the {{CVE|2012-0158|2010-3333|leadout=and}} vulnerabilities.<ref name=Kaspersky /> The attackers use news articles that are relevant to their targets for their spear fishing.<ref name=Proofpoint/>

[[Kaspersky Lab]] found that certain victims that were infected with NetTraveler were also infected by [[Red October (malware)|Red October]], although no direct relation with this malware was established. The multiple infections might be accounted for by the fact that these were high-profile victims like government agencies, nuclear power installations and embassies in dozens of countries.<ref>{{Cite news|url=https://www.csoonline.com/article/2131350/malware-cybercrime/cyberespionage-campaign---39-nettraveler--39--siphoned-data-from-hundreds-of-high.html|title=Cyberespionage campaign 'NetTraveler' siphoned data from hundreds of high-profile targets|last=Constantin|first=Lucian|work=CSO Online|access-date=2018-03-29|language=en}}</ref>

Command and Control servers that were involved in NetTraveler attacks were located in the [[United States]], [[Hong Kong]] and [[China]], which used more than 100 URLs. These C&C servers mostly ran IIS 6/7.

According to Kaspersky Lab, NetTraveler is ''used by a medium-sized threat actor group from China.''

There are several ways to get rid of NetTraveler on an infected system, like with [[Antivirus software|Virus Removal Tool]]s and the SpyHunter Removal Tool. It is also possible to remove this malware manually.<ref name=PC-Remover />

Specially targeted countries included Russia, India, Pakistan, Mongolia, Kyrgyzstan and Kazakhstan.<ref>{{cite web |title=Kaspersky Lab Uncovers 'Operation NetTraveler,' a Global Cyberespionage Campaign Targeting Government-Affiliated Organizations and Research Institutes |url=https://www.kaspersky.com/about/press-releases/2013_kaspersky-lab-uncovers--operation-nettraveler--a-global-cyberespionage-campaign-targeting-government-affiliated-organizations-and-research-institutes |website=kaspersky.com |language=en |date=26 May 2021}}</ref>

== References ==
{{reflist}}

== External links ==
*[https://web.archive.org/web/20171116223849/http://kasperskycontenthub.com/wp-content/uploads/sites/43/vlpdfs/kaspersky-the-net-traveler-part1-final.pdf The NetTraveler (aka ‘Travnet’) by Global Research and Analysis Team of Kaspersky Lab]

[[Category:Spyware]]
[[Category:Cyberwarfare by China]]
[[Category:Cybercrime in India]]

NetTraveler - Revision history

Ajay Kumar: Created a new article