China-based hacking group behind hundreds of attacks on U.S. companies
Hidden Lynx hacking-for-hire group more sophisticated than others, including using malware targeting zero-day flaws, Symantec says
Computerworld - A group of between 50 and 100 professional hackers operating out of China has been systematically targeting businesses, military and government agencies around the world since at least 2009, security vendor Symantec said in a report released on Tuesday.
The group, called Hidden Lynx, is believed connected to the Operation Aurora espionage campaign of 2010 in which dozens of major companies, including Google and Microsoft, were targeted.
More recently, Hidden Lynx was associated with an attack on security vendor Bit9 earlier this year, and also with numerous "watering hole" attacks against hundreds of organizations in the United States.
The group has a long history of attacking organizations in the defense industrial base, financial services sector, education, government, supply chain and the engineering sector, Symantec noted in its report. More than half of the attacks have been against U.S.-based companies, but the group has been going after targets in other countries as well.
What makes Hidden Lynx notable is its access to a seeming arsenal of sophisticated malware tools that includes zero-day vulnerabilities, said Kevin Haley, director of Symantec Security Response.
The tools include one named Trojan.Naid, which the group apparently reserves for use against high-value targets such as those in Operation Aurora. Another, dubbed Backdoor Moudoor, is used for more general-purpose hacking campaigns.
Haley said members of Hidden Lynx appear loosely organized into two teams: an A-team, comprising a relatively small number of elite hackers with access to sophisticated tools like Trojan Naid; and a B-team, which appears comprised mainly of foot soldiers responsible for carrying out large attacks using Backdoor Moudoor and similar tools.
The elite hackers are usually deployed for special operations involving a high-degree of skill and secrecy, Haley noted. Often, this group appears to have advanced knowledge of, and access to, information on fresh zero-day vulnerabilities, Haley said.
The Symantec paper pointed to one incident earlier this year where the Hidden Lynx group used advance knowledge of a zero-day Oracle vulnerability to attack targets in Japan.
One of the more remarkable aspects of the group is its apparent problem solving skills, Haley noted. In situations where members of Hidden Lynx have been unable to penetrate a target directly, they have looked for other ways to compromise them by looking for and exploiting vulnerable suppliers, partners and service providers.
As an example, he pointed to the attack on Bit9 earlier this year in which Hidden Lynx managed to gain access to Bit9's digital code-signing infrastructure. The hacking group used it to sign a total of 32 Trojans and malicious scripts, which it then used to try and infiltrate companies, including a major defense contractor, using Bit9's security services.
Most of the attack infrastructure and tools used in attacks by Hidden Lynx appear to be hosted China. According to Haley, there is not much evidence to suggest that Hidden Lynx is state sponsored. In fact, at least some of the hacking group's victims appear to be based in China.
Rather, members of Hidden Lynx tend to be more hackers-for-hire. The broad range of information and companies they have targeted in the past suggest that the group simply executes tasks on behalf of paying clients. "They are likely tasked with obtaining very specific information that could be used to gain competitive advantages at both a corporate and nation state level," the Symantec report said.
Hidden Lynx itself is unlikely to be using any of the information it steals, Symantec said. "Their mode of operation would suggest that they may be a private organization of 'hackers for hire', who are highly skilled, experienced professionals whose services are available for those willing to pay."
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is firstname.lastname@example.org.
- Syrian Electronic Army shanghais Microsoft's Twitter account, blog
- Is French outrage against U.S. spying misplaced?
- Lawmakers seek answers on Obamacare Data Hub security
- China-based hacking group behind hundreds of attacks on U.S. companies
- How to Prepare for a Potential Syrian Counterattack on the U.S. Power Grid
- New York Times site outage caused by attack on domain registrar, company says
- Cyber drills like Quantum Dawn 2 vital to security in financial sector
- Quantum Dawn 2 will test Wall Street's cyber readiness
- Pentagon accuses China of cyberattacks on U.S military, business targets
- Spamhaus attacks expose huge open DNS server dangers
Read more about Cybercrime and Hacking in Computerworld's Cybercrime and Hacking Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Who's Spying on You? You're aware of the threats of malware to your business but what about the ever-changing ground rules? Cybercriminals today are launching attacks against...
- Pay-as-you-Grow Data Protection: IBM Tivoli's Full-featured Data Protection Suite for Small to Medium Businesses IBM Tivoli Storage Manager Suite for Unified Recovery gives small and medium businesses the opportunity to start out with only the individual solutions...
- Streamline Data Protection with IBM Tivoli Storage Manager Operations Center IBM Tivoli Storage Manager (TSM) has been an industry-standard data protection solution for two decades. But, where most competitors focus exclusively on Backup...
- Simplify and Consolidate Data Protection for Better Business Results Learn about IBM® Tivoli® Storage Manager Operations Center, which provides advanced visualization, built-in analytics and integrated workflow automation features that leapfrog traditional backup...
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,... All Cybercrime and Hacking White Papers | Webcasts