Threat Intelligence

2/24/2015
10:45 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
100%
0%

Cybercrime, Cyber Espionage Tactics Converge

Real-world cyberattack investigations by incident response firm Mandiant highlight how hackers are adapting to better achieve their goals.

To get a sense of just how nation-state attackers are upping their game now, consider this: nearly 80% of phishing emails used in attacks investigated by incident response firm Mandiant last year used IT and security-related topics, or impersonation of those departments or antivirus vendors in order to lure their victims into opening malware-laden attachments and links.

That's a 34% increase since 2013, says Ryan Kazanciyan, technical director at Mandiant, a FireEye company, which today published its annual M-Trends Report on investigations it conducted on behalf of breached businesses in 2014. "That's a fairly significant jump. This is one of those things with the visibility you have that represents the totality of what's out there," he says of how nation-states are now crafting their phishes.

Even more telling -- and confounding for investigators -- is how nation-states are increasingly trying to mask their activity in compromised organizations' networks by using hacking tools typically associated with cybercriminals. Mandiant says there's an increasing blurring of lines between the typical earmarks of a nation-state attack and a financially motivated cybercrime one. "A larger number of areas are a gray area now," Kazanciyan says. "Attackers are adapting their approach to [use tools used] in cybercrime," for example.

Mandiant points to the so-called Sandworm nation-state group's use of the BlackEnergy Trojan as a key example of this shift. Sandworm, which has ties to Russia, has targeted victims in Ukraine with BlackEnergy, as well as against ICS/SCADA networks. Why BlackEnergy? "Using crimeware toolkits such as BlackEnergy in those efforts may provide those attackers a degree of anonymity and plausible deniability," Mandiant's report says.

Kurt Baumgartner, principal security researcher for Kaspersky Lab's global research and analysis team, has spotted four new BlackEnergy plug-in tools created by the Sandworm attack group. The attackers are basically hiding behind the notorious and pervasive cybercrime malware. If an organization is running a sandbox and spots the BlackEnergy malware, it will assume crimeware, not Sandworm, he says.

"You wouldn't suspect it was an APT," just crimeware, says Baumgartner, and miss what was really going on in the attack. "They [Sandworm] are careful how they deploy those plugins, so maintain existence under the radar."

Baumgartner and fellow Kaspersky researcher Maria Garnaeva last week at the Kaspersky Security Analyst Summit in Cancun detailed their latest findings with Sandworm's use of BlackEnergy. Among them was a USB plug-in that Baumgartner says appears to be under development by the attackers. The plug-in would allow an attacker to deliver the malware to an air-gapped system, such as an industrial control system, he says.

"[This] is the start of their implementation. It's not deployed anywhere," he says. "It was compiled, but has yet to be delivered to any victims."

The problem with misidentifying the type of attacker that has infiltrated an organization is that it could hamper the proper incident response, according to Mandiant's report, namely that "stolen personal data in the hands of cyber criminals may require a different response—and have a more immediate impact—than data falling into the hands of a nation-state threat group with other, murkier uses for it."

As more high-profile companies are hit with very public breaches--think Target, Home Depot, Sony, and Anthem--everyone wants to know whodunit, but pinning down the true identity of the attacker or attack group is getting more and more complicated.

"There's more pressure than ever to release attribution. People want to know whodunit, even if [the victim company doesn't] have that information yet. And it's getting harder and harder to attribute accurately. We struggle with it quite a bit," says Kazanciyan, who has worked on such high-profile cases as Sony.

And there are often multiple attacks and attack groups infiltrating an organization at one time. More than a quarter of all enterprise cyberattacks that Mandiant investigates end up involving more than one attack group, according to Kazanciyan. "That's not at all uncommon with major investigations in corporations," he says. Some of these are remnants from previous attacks, he says.

Case in point: one organization that Mandiant assisted post-breach had not known about an attack that had happened some eight years before. "There were dormant artifacts from a previous compromise" we found, he says. "That just means that at some point, they were compromised by this other threat group, and that was the residual" evidence, he says.

Much of older cyberattack remnants Mandiant finds are benign leftovers from a data theft, for instance, he says. "A file we picked up sitting on a server left on a machine … trying to call out to a command-and-control server that no longer exists."

Cybercrime Copying Nation-State

Meanwhile, cybercrime groups also are now adopting some techniques used by nation-states, such as more targeted spearphishing emails and Trojan backdoors that provide them a quiet foothold in their target's networks. Take the Carbanak cybercrime ring out of Eastern Europe, which was exposed last week by Kaspersky Lab. The attackers, which have stolen some $1 billion from more than 100 banks across 30 countries, initially went after bank employees with clever phishing emails. They also employ a Trojan based on Carberp that spies, steals data, and gives them remote access to infected machines.

Among the most interesting techniques used by the Carbanak group was video surveillance--that way, they were able to study and ultimately impersonate a bank clerk transferring money so as not to draw attention. That's a far cry from the smash-and-grab methods typically associated with cybercrime attacks.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
2/25/2015 | 11:51:22 AM
Re: Good coverage of useful data points as usual, but...
Hi there, Stephen. Thanks so much for sharing your thoughts. I thought Ryan Kazanciyan of Mandiant did a good job in my interview with him providing a measured analysis of the data & the report. I completely agree with your point that we only know what we know about the real attacks and groups out there. Reports like Mandiant's are really helpful in providing a good snapshot of the attacks/groups they are seeing in their breach investigation cases. But as you note, they are one org's perspective. 
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
2/25/2015 | 11:06:50 AM
compounding the problem...
Good stuff, Kelly! Attribution is extra complicated by the fact that these tactics are converging, and compounding the problem is the fact that the nature of the criminals themselves are changing. For the longest time, any time people said "Chinese hackers," the assumption was that they were backed by or working for the government. Now we know that there are financially motivated hacking groups in China that probably have nothing to do with the nation-state.
zcobb01
100%
0%
zcobb01,
User Rank: Apprentice
2/25/2015 | 2:51:59 AM
Good coverage of useful data points as usual, but...
I appreciate your coverage of these observations Kelly -- would that other journalists knew this subject area as wel as you do -- yet I worry that the lack of solid data on the true nature and extent of both cyber crime and cyber espionage is even greater than we acknowledge.

Useful as reports based on investigated incidents are, they are just that: the incidents seen by a specific entity, or group of entities in the case of the much anticipated Verizon DBIR. They can tell us some important things, but generalizing from them is fraught with danger, as is the urge to treat them as longitudinal studies.

To be fair to the authors of many of these studies, they include statistical disclaimers. But I think all of us are tempted to say things like "there were X% more of attack type Y this year than last" without including the qualifying factors (like "among cases that happened to be brought to our attention", as opposed to "as experienced by the same sample of organizations that we polled last year"). 

I really appreciated Mandant sharing their encounter "dormant artifacts from a previous compromise". That tells us we didn't have a complete picture before. I doubt we have one now.

Stephen Cobb
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17317
PUBLISHED: 2018-09-21
FruityWifi (aka PatatasFritas/PatataWifi) 2.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the io_mode, ap_mode, io_action, io_in_iface, io_in_set, io_in_ip, io_in_mask, io_in_gw, io_out_iface, io_out_set, io_out_mask, io_out_gw, iface, or domain parameter to /ww...
CVE-2018-17320
PUBLISHED: 2018-09-21
An issue was discovered in UCMS 1.4.6. aaddpost.php has stored XSS via the sadmin/aindex.php minfo parameter in a sadmin_aaddpost action.
CVE-2018-17141
PUBLISHED: 2018-09-21
HylaFAX 6.0.6 and HylaFAX+ 5.6.0 allow remote attackers to execute arbitrary code via a dial-in session that provides a FAX page with the JPEG bit enabled, which is mishandled in FaxModem::writeECMData() in the faxd/CopyQuality.c++ file.
CVE-2018-17173
PUBLISHED: 2018-09-21
LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getThumbnail.
CVE-2018-17174
PUBLISHED: 2018-09-21
A stack-based buffer overflow was discovered in the xtimor NMEA library (aka nmealib) 0.5.3. nmea_parse() in parser.c allows an attacker to trigger denial of service (even arbitrary code execution in a certain context) in a product using this library via malformed data.