Skip to main content

Archimedes - Malware Platform

Leaked documentation has revealed a hacking tool known as Archimedes.
Threat ID:
CC-1440
Category:
Rootkit, Trojan
Threat Severity:
Medium
Threat Vector:
Published:
31 May 2017 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

Leaked documentation has revealed a hacking tool known as Archimedes.

Affected platforms

The following platforms are known to be affected:

Microsoft Windows

Microsoft Windows - All versions

Threat details

Archimedes is able to infiltrate and attack systems inside a Local Area Network (LAN). According to researchers, this exploitation tool can be used to redirect LAN traffic from a target system to a remote attacker.

The malware injects a counterfeit web server response into a user's web browser which can redirect the browser to random malicious destinations, typically an exploit server which provides the appearance of a normal browsing session.

The user guide for Archimedes refers to the malware as an updated version of another tool named 'Fulcrum'. Archimedes offers several improvements on the previous tool.

There are four know versions of Archimedes (1.0, 1.1, 1.2 and 1.3), the modifications introduced with each new version of Archimedes adds new functionality but does not change the default behaviour of the original tool.

Archimedes can perform the following tasks:
Disable the route verification check that occurs prior to exploitation.
Support for a new HTTP injection method based on using a hidden iFrame.
Modification of the DLLs to support the ‘Fire and Forget’ mythology.
Provide a method for the attacker to shut down the tool on demand.

Remediation steps

Type Step
  • Make sure that operating systems and network devices are kept up-to-date.
  • Make sure that cyber-awareness training is kept up-to-date.
  • Monitor for any changes to the DLL or EXE files, which may indicate a potential compromise.
  • Monitor HTTP traffic to identify any malicious activity.

Last edited: 17 February 2020 11:27 am