Yet another global cyber espionage campaign tied to China
Posted on 21 September 2012.
A new cyber espionage campaign targeting energy and military companies and organizations has been unearthed by the researchers of Dell SecureWorks Counter Threat Unit Threat Intelligence.

Dubbed Mirage after the highly persistent Remote Access Tool installed on the targeted machines, the campaign predictably starts with spear-phishing emails aimed at mid-level to senior-level executives. Once the recipients download and run the attachment, they are saddled with the Mirage RAT.

"CTU researchers have identified several files that drop and execute a copy of Mirage onto a target system," says researcher Silas Cutler. "These 'droppers' are designed to look and behave like PDF documents. However, the droppers are stand-alone executable files that open an embedded PDF file and execute the Mirage trojan.

"In one example, CTU researchers observed an executable file that upon execution drops a copy of Mirage and opens an embedded PDF of a news story titled 'Yemeni Women can participate in politics just like men, says President Saleh' that was posted on the Yemen Observer's website.

The attacks have so far been aimed at an oil company in the Phillipines, a military organization in Taiwan, an energy company in Canada, and several as yet unidentified entities in Brazil, Israel, Egypt and Nigeria.

The researchers have analyzed a variety of Mirage variants used in the attacks, and have discovered that some of them had unique attributes not designed for widespread targeting, i.e. that they were custom-made to target specific systems.

Having traced some of the IP addresses connected to the attacks back to a subnet of the Beijing province network, the researchers believe that the attackers are operating from China.

"Traditionally, the success of botnets created by threat actor groups has been measured by the quantity of infected systems and the difficulty to defend against in the long term. These targeted attacks show that a successful campaign requires only small quantity of infected systems to accomplish the attackers' objectives and to yield extremely powerful results," say the researchers.

"For companies in the targeted industries, it is important to have a strong perimeter security line in place. Using active intrusion detection and prevention systems as well as DNS monitoring for malicious domains is essential to detecting this activity."






Spotlight

eBook: Cybersecurity for Dummies

Posted on 16 December 2014.  |  APTs have changed the world of enterprise security and how networks and organizations are attacked. These threats, and the cybercriminals behind them, are experts at remaining hidden from traditional security while exhibiting an intelligence, resiliency, and patience that has never been seen before.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  
DON'T
MISS

Fri, Dec 19th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //