Threat Intelligence
2/24/2015
10:45 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
100%
0%

Cybercrime, Cyber Espionage Tactics Converge

Real-world cyberattack investigations by incident response firm Mandiant highlight how hackers are adapting to better achieve their goals.

To get a sense of just how nation-state attackers are upping their game now, consider this: nearly 80% of phishing emails used in attacks investigated by incident response firm Mandiant last year used IT and security-related topics, or impersonation of those departments or antivirus vendors in order to lure their victims into opening malware-laden attachments and links.

That's a 34% increase since 2013, says Ryan Kazanciyan, technical director at Mandiant, a FireEye company, which today published its annual M-Trends Report on investigations it conducted on behalf of breached businesses in 2014. "That's a fairly significant jump. This is one of those things with the visibility you have that represents the totality of what's out there," he says of how nation-states are now crafting their phishes.

Even more telling -- and confounding for investigators -- is how nation-states are increasingly trying to mask their activity in compromised organizations' networks by using hacking tools typically associated with cybercriminals. Mandiant says there's an increasing blurring of lines between the typical earmarks of a nation-state attack and a financially motivated cybercrime one. "A larger number of areas are a gray area now," Kazanciyan says. "Attackers are adapting their approach to [use tools used] in cybercrime," for example.

Mandiant points to the so-called Sandworm nation-state group's use of the BlackEnergy Trojan as a key example of this shift. Sandworm, which has ties to Russia, has targeted victims in Ukraine with BlackEnergy, as well as against ICS/SCADA networks. Why BlackEnergy? "Using crimeware toolkits such as BlackEnergy in those efforts may provide those attackers a degree of anonymity and plausible deniability," Mandiant's report says.

Kurt Baumgartner, principal security researcher for Kaspersky Lab's global research and analysis team, has spotted four new BlackEnergy plug-in tools created by the Sandworm attack group. The attackers are basically hiding behind the notorious and pervasive cybercrime malware. If an organization is running a sandbox and spots the BlackEnergy malware, it will assume crimeware, not Sandworm, he says.

"You wouldn't suspect it was an APT," just crimeware, says Baumgartner, and miss what was really going on in the attack. "They [Sandworm] are careful how they deploy those plugins, so maintain existence under the radar."

Baumgartner and fellow Kaspersky researcher Maria Garnaeva last week at the Kaspersky Security Analyst Summit in Cancun detailed their latest findings with Sandworm's use of BlackEnergy. Among them was a USB plug-in that Baumgartner says appears to be under development by the attackers. The plug-in would allow an attacker to deliver the malware to an air-gapped system, such as an industrial control system, he says.

"[This] is the start of their implementation. It's not deployed anywhere," he says. "It was compiled, but has yet to be delivered to any victims."

The problem with misidentifying the type of attacker that has infiltrated an organization is that it could hamper the proper incident response, according to Mandiant's report, namely that "stolen personal data in the hands of cyber criminals may require a different response—and have a more immediate impact—than data falling into the hands of a nation-state threat group with other, murkier uses for it."

As more high-profile companies are hit with very public breaches--think Target, Home Depot, Sony, and Anthem--everyone wants to know whodunit, but pinning down the true identity of the attacker or attack group is getting more and more complicated.

"There's more pressure than ever to release attribution. People want to know whodunit, even if [the victim company doesn't] have that information yet. And it's getting harder and harder to attribute accurately. We struggle with it quite a bit," says Kazanciyan, who has worked on such high-profile cases as Sony.

And there are often multiple attacks and attack groups infiltrating an organization at one time. More than a quarter of all enterprise cyberattacks that Mandiant investigates end up involving more than one attack group, according to Kazanciyan. "That's not at all uncommon with major investigations in corporations," he says. Some of these are remnants from previous attacks, he says.

Case in point: one organization that Mandiant assisted post-breach had not known about an attack that had happened some eight years before. "There were dormant artifacts from a previous compromise" we found, he says. "That just means that at some point, they were compromised by this other threat group, and that was the residual" evidence, he says.

Much of older cyberattack remnants Mandiant finds are benign leftovers from a data theft, for instance, he says. "A file we picked up sitting on a server left on a machine … trying to call out to a command-and-control server that no longer exists."

Cybercrime Copying Nation-State

Meanwhile, cybercrime groups also are now adopting some techniques used by nation-states, such as more targeted spearphishing emails and Trojan backdoors that provide them a quiet foothold in their target's networks. Take the Carbanak cybercrime ring out of Eastern Europe, which was exposed last week by Kaspersky Lab. The attackers, which have stolen some $1 billion from more than 100 banks across 30 countries, initially went after bank employees with clever phishing emails. They also employ a Trojan based on Carberp that spies, steals data, and gives them remote access to infected machines.

Among the most interesting techniques used by the Carbanak group was video surveillance--that way, they were able to study and ultimately impersonate a bank clerk transferring money so as not to draw attention. That's a far cry from the smash-and-grab methods typically associated with cybercrime attacks.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
2/25/2015 | 11:51:22 AM
Re: Good coverage of useful data points as usual, but...
Hi there, Stephen. Thanks so much for sharing your thoughts. I thought Ryan Kazanciyan of Mandiant did a good job in my interview with him providing a measured analysis of the data & the report. I completely agree with your point that we only know what we know about the real attacks and groups out there. Reports like Mandiant's are really helpful in providing a good snapshot of the attacks/groups they are seeing in their breach investigation cases. But as you note, they are one org's perspective. 
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
2/25/2015 | 11:06:50 AM
compounding the problem...
Good stuff, Kelly! Attribution is extra complicated by the fact that these tactics are converging, and compounding the problem is the fact that the nature of the criminals themselves are changing. For the longest time, any time people said "Chinese hackers," the assumption was that they were backed by or working for the government. Now we know that there are financially motivated hacking groups in China that probably have nothing to do with the nation-state.
zcobb01
100%
0%
zcobb01,
User Rank: Apprentice
2/25/2015 | 2:51:59 AM
Good coverage of useful data points as usual, but...
I appreciate your coverage of these observations Kelly -- would that other journalists knew this subject area as wel as you do -- yet I worry that the lack of solid data on the true nature and extent of both cyber crime and cyber espionage is even greater than we acknowledge.

Useful as reports based on investigated incidents are, they are just that: the incidents seen by a specific entity, or group of entities in the case of the much anticipated Verizon DBIR. They can tell us some important things, but generalizing from them is fraught with danger, as is the urge to treat them as longitudinal studies.

To be fair to the authors of many of these studies, they include statistical disclaimers. But I think all of us are tempted to say things like "there were X% more of attack type Y this year than last" without including the qualifying factors (like "among cases that happened to be brought to our attention", as opposed to "as experienced by the same sample of organizations that we polled last year"). 

I really appreciated Mandant sharing their encounter "dormant artifacts from a previous compromise". That tells us we didn't have a complete picture before. I doubt we have one now.

Stephen Cobb
Register for Dark Reading Newsletters
Dark Reading Live EVENTS
INsecurity - For the Defenders of Enterprise Security
A Dark Reading Conference
While red team conferences focus primarily on new vulnerabilities and security researchers, INsecurity puts security execution, protection, and operations center stage. The primary speakers will be CISOs and leaders in security defense; the blue team will be the focus.
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Darn - typed UNICORN instead of UNICODE.  
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.