Gamarue malware found on government-issued school laptops

An undisclosed number of refurbished laptops given to vulnerable children in England have been found to be loaded with malware that is communicating with command and control (C2) server infrastructure located in Russia.

The laptops were handed out to support home-schooling efforts during the current national lockdown, according to BBC reporting, and the suspicious software – found to be the Gamarue trojan – was discovered on a small number of devices by teachers at a school in Bradford. It is not yet known exactly how many devices were compromised, or to how many schools they were inadvertently sent.

Also known as Andromeda, Gamarue is part of a family of trojans that compromises victim devices via malicious attachments to spam emails. It is capable of using its victims to send more spam email messages, downloading and installing other malwares, and copying itself to removable media, such as USB drives.

Gamarue was first identified nine years ago, and prior to the 2017 takedown of the botnet behind it in an international operation, was one of the more widespread malwares in circulation.

The Department for Education (DfE) said it was aware of the issue but said it was confined to a small number of devices at a small number of schools, understood to be in the single digits. An investigation is underway, and its IT team is in touch with the school/s concerned.

A spokesperson told Computer Weekly: “We have been investigating an issue with malware that was found on a small number of the laptops provided to schools as part of our Get Help With Technology Programme.

“In all known cases, the malware was detected and removed at the point schools first turned the devices on.

“We take online safety and security extremely seriously and we will continue to monitor for any further reports of malware. Any schools that may have concerns should contact the Department for Education.”

Its discovery is not necessarily a sign that Gamarue is re-emerging as a significant threat at this time, but does indicate some level of failure in the government to adequately prepare the refurbished devices for redistribution.

Tom Lysemose Hansen, chief technology officer of Promon, described the incident as appalling. “When it comes to issuing equipment such as laptops to schools, the bar is very low – ensure the laptops are safe to use and won’t pose a risk to the children using them,” he said.

“As is to be expected, children do not, in most cases, have the technical expertise to recognise that their equipment is compromised in any way. Luckily this issue doesn’t seem to be widespread. However, any parents who receive a free laptop from a school for their child should be on the lookout for any suspicious behaviour such as pop-ups or strange applications appearing.

“Endpoint security should be a top priority for both the government and for schools, who must also put in the work to vet any and all devices issued and, although sad to say, should not assume that just because it’s been issued by a governing body that it is automatically free from malware,” said Hansen.

Redscan threat intelligence head George Glass said: “The fact that these devices were not checked and scrubbed before being sent to vulnerable children is a concern. The Gamarue worm is not a new malware strain, it was first discovered in 2011 and is just one example of hundreds of such threats that may reside on old, unchecked devices. 

“If such an old worm was discovered on these machines it may not be the only nasty surprise. It’s certainly possible that newer and more severe malware strains are present on devices too.  

“Any families in receipt of a laptop should ensure that antivirus software is installed,” said Glass. “As an added precaution, people should also avoid using these devices for anything other than learning. For instance, they shouldn’t be used for accessing email and online bank accounts. If an infection is detected, then the laptop should be powered down immediately and returned to the local authority for inspection.”