Researchers uncover new global cyberespionage operation dubbed Safe
The attack infected computers belonging to companies, governments and other organizations from over 100 countries, Trend Micro says
IDG News Service - Security researchers from Trend Micro have uncovered an active cyberespionage operation that so far has compromised computers belonging to government ministries, technology companies, media outlets, academic research institutions and nongovernmental organizations from over 100 countries.
The operation, which Trend Micro has dubbed Safe, targets potential victims using spear phishing emails with malicious attachments. The company's researchers have investigated the operation and published a research paper with their findings (download PDF).
The investigation uncovered two sets of command-and-control (C&C) servers used for what appear to be two separate Safe attack campaigns that have different targets, but use the same malware.
One campaign uses spear phishing emails with content related to Tibet and Mongolia. These emails have .doc attachments that exploit a Microsoft Word vulnerability patched by Microsoft in April 2012.
Access logs gathered from this campaign's C&C servers revealed a total of 243 unique victim IP (Internet Protocol) addresses from 11 different countries. However, the researchers found only three victims that were still active at the time of their investigation, with IP addresses from Mongolia and South Sudan.
The C&C servers corresponding to the second attack campaign logged 11,563 unique victim IP addresses from 116 different countries, but the actual number of victims is likely to be much lower, the researchers said. On average, 71 victims were actively communicating with this set of C&C servers at any given time during the investigation, they said.
The attack emails used in the second attack campaign have not been identified, but the campaign appears to be larger in scope and the victims more widely dispersed geographically. The top five countries by victim IP address count are India, the U.S., China, Pakistan, the Philippines and Russia.
The malware installed on the infected computers is primarily designed to steal information, but its functionality can be enhanced with additional modules. The researchers found special-purpose plug-in components on the command and control servers, as well as off-the-shelf programs that can be used to extract saved passwords from Internet Explorer and Mozilla Firefox, as well as Remote Desktop Protocol credentials stored in Windows.
"While determining the intent and identity of the attackers often remains difficult to ascertain, we determined that the Safe campaign is targeted and uses malware developed by a professional software engineer that may be connected to the cybercriminal underground in China," the Trend Micro researchers said in their paper. "This individual studied at a prominent technical university in the same country and appears to have access to an Internet services company's source code repository."
The operators of the C&C servers accessed them from IP addresses in several countries, but most often from China and Hong Kong, the Trend Micro researchers said. "We also saw the use of VPNs and proxy tools, including Tor, which contributed to the geographic diversity of the operators' IP addresses."
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Who's Spying on You? You're aware of the threats of malware to your business but what about the ever-changing ground rules? Cybercriminals today are launching attacks against...
- Is Your Big Data Solution Production-Ready? Read "Is Your Big Data Solution Production-Ready?" now, and discover best practices and actionable steps to implementing a production-ready big data solution.
- Pay-as-you-Grow Data Protection: IBM Tivoli's Full-featured Data Protection Suite for Small to Medium Businesses IBM Tivoli Storage Manager Suite for Unified Recovery gives small and medium businesses the opportunity to start out with only the individual solutions...
- Streamline Data Protection with IBM Tivoli Storage Manager Operations Center IBM Tivoli Storage Manager (TSM) has been an industry-standard data protection solution for two decades. But, where most competitors focus exclusively on Backup...
- Webinar: Building a Big Data solution that's production-ready Big data solutions are no longer just a nice-to-have.
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well... All Cybercrime and Hacking White Papers | Webcasts