Cyber Spying, Digital Theft & Espionage
Cyber spying, digital theft and espionage are about obtaining secret.png)
information without the permission and knowledge of the holder of the information. This data is taken from individuals, competitors, rivals, groups, governments and enemies for personal, economic, political or military advantage using proxy servers, cracking techniques and malware software.
A group of ecurity researchers callled Malware HunterTeam have recently encountered a new macOS malware sample believed to be the work of the North Korean group of hackers known as Lazarus. The threat has a very low detection rate and comes with capabilities that allow it to retrieve a payload from a remote location and run it in memory, making the forensic analysis more difficult.
Another recent study of cyber espionage activities shows that more than 200 unique families of malware have been used to eavesdrop on corporate and government employees, including attacks on the Japanese government.
These malware spies have formed armies of nefarious hackers from around the world who use cyber warfare for economic, political, or military gain.
These deliberately recruited and highly valued cybercriminals have the technical know-how to shut down anything from government infrastructures to financial systems or utility resources. They have influenced the outcome of political elections, created havoc at international events, and helped companies succeed or fail.
Many of these attackers use advance persistent threats (APTs) as their modus operandi to stealthily enter networks or systems and remain undetected for years and years.
These state-based threat actor teams are comprised of computer programmers, engineers, and scientists that form military and intelligence agency hacking clusters. They have tremendous financial backing and unlimited technological resources that help them evolve their techniques rapidly.
More than 200 unique families of malware have been used to eavesdrop on corporate and government employees, including attacks on the Japanese government, according to the results of a study of cyber-espionage activities released on July 25.
Unlike the massive botnets used by cyber-criminals to steal cash, such as the Gameover Zeus botnet, the espionage botnets typically consist of hundreds of compromised computers rather than tens or hundreds of thousands.
Most of the activity traces back to China, but some spying does not, including espionage carried out by a private security company that advertised "ethical" hacking courses, according to Dell Secureworks, which carried out the investigation. They identified over 1,100 domain names used in the attacks and registered by online spies.
The Secureworks researchers identified many of the domains by finding suspicious domains and, when possible, registering them as they expired. He then listened for signs of botnet activity, an activity known as "sinkholing."
Tapping this communication channel allowed Dell Secureworks to peer into the botnet's operation, including who had been infected. Stewart identified the malware into families based on the code and the network traffic each produced. Among the botnet activities caught in Stewart's sinkholing efforts were multiple attacks on Japanese targets, including government ministries, universities, municipal governments, trade organizations, think tanks, the manufacturing industry and the media.
Another sinkhole identified a relatively unknown piece of malware known as Elirks, which uses the Plurk microblogging service to communicate with its network of compromised computers. The attackers also used the service to post the current location of the command-and-control server, so that nodes ready to exfiltrate data can identify themselves and allow their controllers to log in. At least a dozen Plurk accounts were actively being used to communicate with infected systems, Stewart said in the report.
While not every company is in danger of becoming a target of cyber-spies, attackers tend to use the same techniques, much of it spread via carefully crafted email messages and targeted attacks.
Attacks aimed at stealing classified information from government agencies or trade secrets from corporations are also on the rise. Since Google outed Chinese hackers in a massive operation against some three-dozen U.S. and multinational companies, evidence has grown of widespread China-sanctioned espionage against governments, industry and human-rights groups.
China is not alone, however. Other countries-most notably the United States-have also used programs to infiltrate sensitive networks, steal information and interfere with other nations' activities. The US government has disclosed that it was responsible for developing Stuxnet and used it as an attack method on Iran's nuclear weapond program.
eWeek: CarbonBlack: Bleeping Computer:
You Might Also Read:
