By Sophie Curtis

A new strain of the Sykipot malware is being used by Chinese cyber criminals to compromise US Department of Defense (DoD) smart cards, a new report has revealed.

The malware has been designed to take advantage of smart card readers running ActivClient – the client application of ActivIdentity – according to unified security information and event management (SIEM) company AlienVault.

ActivIdentity’s smart cards are standardised at the DoD and a number of other US government agencies. The cards are used to identify active duty military staff, selected reserve personnel, civilian employees, and eligible contractor staff.

As with previous Sykipot strains, the attackers use an email campaign to get specific targets to click on a link and deposit the Sykipot malware onto their machines. After identifying the computers that have card readers, the attackers install keystroke logging software to steal the PIN number that is used in concert with the smart card.

“When a card is inserted into the reader, the malware acts as the authenticated user and can access sensitive information,” explained AlienVault’s lab manager Jaime Blasco. “The malware is then controlled by the attackers and then told what – and when – to steal the appropriate data.”

So far, AlienVault has seen attacks that compromise smart card readers running Windows Native x509 software, which is reportedly in commonplace use amongst a number of US government and allied agencies.

This new strain is thought to have originated from the same Chinese authors that created a version of Sykipot in 2011, which distributed a variety of spam messages claiming to contain information on the next-generation unmanned “drones”, developed by the United States Air Force.

In an investigation into that earlier strain last year, Blasco suggested that the team behind Sykibot was working with an information “shopping list” that included semiconductor, medical and aerospace technology.

In a report released least year, security consultancy Mandiant identified several cases where determined attackers were able to get onto computers or networks that required both smart cards and passwords. Mandiant called this technique a “smart card proxy”.


  1. Everyone loves what you guys are up too. This kind of
    clever work and exposure! Keep up the supeerb works guys I’ve incorporated you uys to

    Check out mmy web sitte

  2. Reinaldo 2 months ago

    If you would like tto obtain a good deal from this paragraph then you have
    to applly such techniques to your won website.

    Feel free tto visit my homepawge … Reinaldo

  3. Hi everybody, here every one is sharing these kinds of familiarity, thus it’s pleasant to read this
    blog, and I used to pay a visit this webste daily.

    My web page …

Leave a reply

Your email address will not be published. Required fields are marked *


Copyright © 2024 All rights reserved

Log in with your credentials

Forgot your details?