Digital stakeout of Chinese hacker gang reveals 100+ victims
Crew behind 'Comfoo' RAT may have rooted through videoconferencing vendor for ways to watch confidential meetings in government, businesses
Computerworld - A Chinese hacker gang whose malware targeted RSA in 2011 infiltrated more than 100 companies and organizations, and was so eager to steal data that it probed a major teleconference developer to find new ways to spy on corporations, according to researchers.
The remote-access Trojan, or RAT, tagged as "Comfoo" is largely inactive, said a pair of veteran researchers from Dell SecureWorks, who presented their findings at last week's Black Hat security conference.
But their discoveries showed just how pervasively a dedicated group of attackers can infiltrate networks and walk away with secrets.
"We're not seeing it used to the extent it was before," said Joe Stewart, director of malware research at SecureWorks, in explaining why he and his college, Don Jackson, revealed their undercover campaign.
For more than 18 months, Stewart and Jackson, a senior security researcher with SecureWorks' Counter Threat Unit (CTU), secretly monitored some of the workings of Comfoo, which they believe was the work of a hacker crew they've named the Beijing Group. The gang is one of China's top-two hacker organizations.
To start, Stewart captured a sample of the malware used in the RSA attack, at the time attributed to Chinese hackers, then reverse-engineered the encryption that the malware used to mask instructions to and from the gang's command-and-control (C&C) servers.
Eventually, Stewart was able to spy on the hackers as they logged onto those C&C servers. As they did, Stewart snatched the victims' MAC addresses -- unique identifiers for network hardware -- their IP, or "Internet protocol" addresses, and finally, a tag the hackers used to label each data-stealing campaign.
SecureWorks was not able to see what data the attackers were stealing, but their passive monitoring reaped dividends.
"We've done similar ops like this before," said Stewart, "but with the custom stuff, you rarely get this kind of insight or this level of detail of the attacks and victims."
SecureWorks said its stealthy stakeout -- which was intermittent to ensure that the hackers weren't aware they were watching -- uncovered over 100 victims, more than 64 different campaigns and 200-plus Comfoo variants. The Atlanta-based security firm notified some of the victims directly, and others through CERTs, the computer emergency response teams that governments maintain.
"This was just a snapshot of the [total] victims," cautioned Stewart.
The hackers targeted a wide range of government agencies and ministries, private companies and trade organizations in fields as diverse as energy, media, semiconductors and telecommunications. They seemed eager to grab information from almost anywhere and anyone, although the victims were concentrated in Japan, India, South Korea and the U.S.
- Path Selection Infographic Path Selection Infographic
- Hyperconvergence Infographic A wide range of observers agree that data centers are now entering an era of "hyperconvergence" that will raise network traffic levels faster...
- Preparing Your Infrastructure for the Hyperconvergence Era From cloud computing and virtualization to mobility and unified communications, an array of innovative technologies is transforming today's data centers.
- How WAN Optimization Helps Enterprises Reduce Costs If you wanted to break down innovation into a tidy equation, it might go something like this: Technology + Connectivity = Productivity. Productivity...
- Cloud Knowledge Vault Learn how your organization can benefit from the scalability, flexibility, and performance that the cloud offers through the short videos and other resources...
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users? All Cybercrime and Hacking White Papers | Webcasts