NetTraveler
NetTraveler, also known as Travnet, is a Trojan used in long-running targeted cyberespionage operations. Kaspersky reported the broader NetTraveler campaign compromised more than 350 high-profile victims across over 40 countries over roughly eight years, with total victims estimated at around 1,000. Victims included political activists, research centers, government institutions, embassies, military contractors, private companies, weapons manufacturers, human-rights activists, and pro-democracy groups. Reported geographic targeting included Mongolia, Russia, India, Kazakhstan, Belarus, and other European countries.
NetTraveler is designed primarily for document theft and basic computer surveillance. It steals documents including DOC, XLS, PPT, RTF, and PDF files; some configurations also targeted CDR, DWG, DXF, CDW, and DWF files. The malware includes keylogging capability and reports window names together with keylogger data to provide application context.
Observed delivery commonly relied on spear-phishing. Reported infection vectors included malicious Microsoft Word documents exploiting CVE-2012-0158 and CVE-2010-3333, as well as links to RAR-compressed self-extracting executables hosted on lookalike news and military-themed domains. Some exploit documents were built with MNKit. Proofpoint reported the actor used victim-relevant geopolitical, military, and energy-themed lures based on real news articles.
NetTraveler has been observed using DLL side-loading with legitimate signed executables such as fsguidll.exe and RasTls.exe to load malicious DLLs including fslapi.dll or rastls.dll. It used a dropped configuration file, config.dat, containing parameters such as U00P for C2, K00P for DES key, P00D for sleep time, and F00G for proxy settings. An example configuration referenced the path hxxp://www.tassnews[.]net/revenge/dk/downloader.asp.
The malware and campaign were associated in reporting with China-linked espionage activity. Kaspersky assessed the NetTraveler group had around 50 members and that most were native Chinese speakers with some English knowledge. Proofpoint assessed a related operator targeting Russia and neighboring countries likely operated out of China. Infrastructure overlaps were reported between NetTraveler and later ZeroT/PlugX activity, including shared C2 domains such as www.tassnews[.]net, www.riaru[.]net, and www.versig[.]net. Additional domains associated with NetTraveler activity included www.interfaxru[.]com, www.voennovosti[.]com, www.info-spb[.]com, and www.mogoogle[.]com; one reported IP was 103.231.184[.]164.
NetTraveler was first observed as early as 2004, with earliest identified samples timestamped 2005 and the largest number of samples created between 2010 and 2013. Kaspersky analyzed command-and-control logs dating back to 2009 and reported more than 22 GB of stolen data stored on NetTraveler servers, noting this represented only a fraction of the total exfiltrated data. Securelist also cited NetTraveler among malware families that have used steganography.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The primary attack method consists of spear-phishing emails carrying malicious documents that exploit two remote code execution vulnerabilities that affect Microsoft Office, namely CVE-2012-0158 and CVE-2010-3333, in order to install the malware. | Researchers from antivirus vendor Kaspersky Lab named the campaign NetTraveler, after a string found in the main data stealing malware associated with the attacks. NetTraveler, also known as Travnet, is designed to steal documents, primarily DOC, XLS, PPT, RTF and PDF, and to perform basic computer surveillance.
Researchers from antivirus vendor Kaspersky Lab named the campaign NetTraveler, after a string found in the main data stealing malware associated with the attacks. NetTraveler, also known as Travnet, is designed to steal documents, primarily DOC, XLS, PPT, RTF and PDF, and to perform basic computer surveillance. | The primary attack method consists of spear-phishing emails carrying malicious documents that exploit two remote code execution vulnerabilities that affect Microsoft Office, namely CVE-2012-0158 and CVE-2010-3333, in order to install the malware.
Techniques & procedures
5 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 techniqueThe primary attack method consists of spear-phishing emails carrying malicious documents that exploit two remote code execution vulnerabilities that affect Microsoft Office, namely CVE-2012-0158 and CVE-2010-3333, in order to install the malware.
Execution
1 techniqueThe primary attack method consists of spear-phishing emails carrying malicious documents that exploit two remote code execution vulnerabilities that affect Microsoft Office, namely CVE-2012-0158 and CVE-2010-3333, in order to install the malware.
Credential Access
1 techniqueDiscovery
1 techniqueMultiple malware families are described as identifying/enumerating open windows or capturing foreground window titles (e.g., via EnumWindows, GetForegroundWindow, GetWindowText) to understand user activity and provide context for keylogging/screencapture.
Collection
2 techniquesNetTraveler, also known as Travnet, is designed to steal documents, primarily DOC, XLS, PPT, RTF and PDF, and to perform basic computer surveillance. However, some configurations target extended lists of files, including those with extensions like CDR... or DWG, DXF, CDW and DWF...
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Семейство вредоносного ПО, упомянутое как использующее стеганографию для сокрытия данных или коммуникаций.
Backdoor family referenced via C2 infrastructure overlap/WHOIS linkage in the report’s pivoting analysis.
Espionage-focused trojan family associated with the same China-linked activity; shares C2 infrastructure/domains with ZeroT in the described campaigns.
Cyber-espionage trojan delivered via spear-phishing (RAR SFX executables and Word docs exploiting CVE-2012-0158). Uses DLL side-loading (e.g., fsguidll.exe->fslapi.dll or RasTls.exe->rastls.dll) and a config.dat containing encrypted C2 and DES key material; communicates with attacker-controlled C2 domains mimicking news/military sites.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.