The Best Spies Money Can Buy

During the past decade, cybercriminals have specialized in the various tasks needed to compromise computers, steal data, and make money. Now, more elusive nation-state attackers could be using rented botnets and cybercriminal services to streamline their own operations, security experts say.

In June, security firm FireEye detected evidence of such a connection when it found instances of a remote-access Trojan whose code seemed to have been reused to infect machines with fake antivirus software. In another incident, cybercriminals sold access to compromised military and government computers, allowing would-be cyberspies to get direct access to their targets, says Darien Kindlund, senior staff scientist at FireEye.

The two examples are part of a building body of evidence that suggests attackers representing what the military and security industry refer to as the advanced persistent threat (APT) are not shying away from using criminals' resources to help them in their missions.

"If military and government hosts are being sold on the black market, who are the most likely buyers -- spammers?' No, they could buy something cheaper on a different network. But for APT? 'Yes, it meets their mission objectives," Kindlund says.

Criminals looking to rent time on a botnet will likely try to avoid using military and government servers for fear of more intense repercussions. Yet the same servers are the targets for APT attacks, Kindlund argues. The cybercriminal element on the Internet certainly seems ready to handle sales of botnets to any comer, including espionage agents.

"These malware criminals may not necessarily know that their buyers are APT actors because they provide generic, easy-to-use Web interfaces to allow anyone to 'rent' machine time on compromised systems," Kindlund says.

McAfee acknowledges that buying hacked systems within a targeted company would be an easy way to get behind the company's defenses. Yet the company has not found much evidence of espionage agents using criminal botnets to carry out their missions, says Stuart McClure, general manager for risk compliance at McAfee. Contacting a criminal group to purchase compromised machines carries a large risk of tipping the hand of a spy, he says.

"If I was the bad guy, I would go after the command-and-control servers themselves and just hack those," McClure says. "Then I would figure out which systems the C&Cs had control over, and I would just take over those."

Other security firms also believe the link between cybercriminals and nation-state attackers might be fairly uncommon. Evidence linking code might not mean a common code base, but a common exploit, says Rik Ferguson, director of security research for Trend Micro's Europe, Middle East, and Africa business unit.

"There is very little crossover in terms of the actual Trojan malware used in espionage attacks versus criminal attacks," Ferguson says. "However, there may be crossovers in terms of the vulnerabilities that cause the initial infection."

In the end, it depends on who is trying to steal information. It's unlikely that an intelligence agency will go to the only version of the mob and ask for an informant in a particular company or government office, McAfee's McClure says. Instead, they will create their own tools.

"At the end of the day, if you are a spy agency, you are going to develop your own stuff," he says. ""You may get ideas from others ... but I don't think the elite guys are ever going" to do business with criminals, he says.

Yet,criminals could decide that the market for intellectual property is lucrative enough to make a profit. In that case, all bets are off, FireEye's Kindlund says.

"If we look at the logical conclusion of this trend, we see that eventually different cybercrime groups emerge, each specializing in different stages of the overall 'business' model ... [including] exfiltrated intel sales," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.