Digital stakeout of Chinese hacker gang reveals 100+ victims
Crew behind 'Comfoo' RAT may have rooted through videoconferencing vendor for ways to watch confidential meetings in government, businesses
Computerworld - A Chinese hacker gang whose malware targeted RSA in 2011 infiltrated more than 100 companies and organizations, and was so eager to steal data that it probed a major teleconference developer to find new ways to spy on corporations, according to researchers.
The remote-access Trojan, or RAT, tagged as "Comfoo" is largely inactive, said a pair of veteran researchers from Dell SecureWorks, who presented their findings at last week's Black Hat security conference.
But their discoveries showed just how pervasively a dedicated group of attackers can infiltrate networks and walk away with secrets.
"We're not seeing it used to the extent it was before," said Joe Stewart, director of malware research at SecureWorks, in explaining why he and his college, Don Jackson, revealed their undercover campaign.
For more than 18 months, Stewart and Jackson, a senior security researcher with SecureWorks' Counter Threat Unit (CTU), secretly monitored some of the workings of Comfoo, which they believe was the work of a hacker crew they've named the Beijing Group. The gang is one of China's top-two hacker organizations.
To start, Stewart captured a sample of the malware used in the RSA attack, at the time attributed to Chinese hackers, then reverse-engineered the encryption that the malware used to mask instructions to and from the gang's command-and-control (C&C) servers.
Eventually, Stewart was able to spy on the hackers as they logged onto those C&C servers. As they did, Stewart snatched the victims' MAC addresses -- unique identifiers for network hardware -- their IP, or "Internet protocol" addresses, and finally, a tag the hackers used to label each data-stealing campaign.
SecureWorks was not able to see what data the attackers were stealing, but their passive monitoring reaped dividends.
"We've done similar ops like this before," said Stewart, "but with the custom stuff, you rarely get this kind of insight or this level of detail of the attacks and victims."
SecureWorks said its stealthy stakeout -- which was intermittent to ensure that the hackers weren't aware they were watching -- uncovered over 100 victims, more than 64 different campaigns and 200-plus Comfoo variants. The Atlanta-based security firm notified some of the victims directly, and others through CERTs, the computer emergency response teams that governments maintain.
"This was just a snapshot of the [total] victims," cautioned Stewart.
The hackers targeted a wide range of government agencies and ministries, private companies and trade organizations in fields as diverse as energy, media, semiconductors and telecommunications. They seemed eager to grab information from almost anywhere and anyone, although the victims were concentrated in Japan, India, South Korea and the U.S.
- Using Cyber Insurance and Cybercrime Data to Limit Your Business Risk This paper examines the challenges of understanding cyber risks, the importance of having the right cyber risk intelligence, and how to use this...
- 5 Tips to Secure Small Business Backdoors in the Enterprise Supply Chain This paper examines the insecurity of the small businesses in the supply chain and offers tips to close those backdoors into the enterprise.
- Comprehensive Advanced Threat Defense The hot topic in the information security industry these days is "Advanced Threat Defense" (ATD). This paper describes a comprehensive, network-based approach to...
- Advanced Threat Defense: A Comprehensive Approach In this interview, Peter George, president, General Dynamics Fidelis Cybersecurity Solutions, explains why we need more than anti-malware, and what constitutes a comprehensive...
- Live Webcast Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- NSS Labs & Cisco Present: Evaluating Leading Breach Detection Systems Today's constantly evolving advanced malware and APTs can evade point-in-time defenses to penetrate networks. Security professionals must evolve their strategy in lockstep to... All Cybercrime and Hacking White Papers | Webcasts