Attacks/Breaches

2/17/2017
03:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

At Least 70 Organizations Targeted In Sophisticated Cyber Surveillance Operation

Most of the targets are in Ukraine, though a few have been spotted in Russia and elsewhere, CyberX says

At least 70 organizations across multiple industries including critical infrastructure, scientific research and media have been hit in a sophisticated cyber-surveillance campaign conducted by threat actors with potential nation state connections.

A majority of the victim organizations are Ukraine based, though a handful of targets have also been spotted in Russia, Austria and Saudi Arabia as well. 

Security vendor CyberX uncovered the operation after discovering malware used in the attacks in the wild and then reverse engineering it.

The company has dubbed the campaign Operation BugDrop because one of the methods employed by the threat actors behind it to collect data is to eavesdrop on conversations via the victim’s PC microphone. The tactic is highly effective because a computer microphone, unlike a video camera, is almost impossible to block without actually disabling the associated hardware, CyberX noted in a blog.

The focus of BugDrop appears to be to capture a range of sensitive information from targets via audio recordings of conversations and via documents, screenshots and passwords from victim system, according to CyberX.

The targeting of the victims is similar to that of Operation Groundbait, a cyber surveillance campaign uncovered by ESET last May.

As with the Groundbait campaign, many of the victims of BugDrop are located in Luhansk and Donetsk, two states that have proclaimed themselves to be independent from Ukraine and are regarded as terrorist states for that reason by the government there. Many of the tactics, techniques and procedures used in the BugDrop campaign — including the use of spear phishing emails and malicious macros — are also similar to those used in Groundbait.

Even so, BugDrop appears to be a more sophisticated and better-resourced operation than Groundbait, says Phil Neray, vice president of industrial control security at CyberX.

For example, the operators of BugDrop are using DropBox to store data exfiltrated from victim systems, making it harder to spot the illegal activity. “DropBox is a cloud-based service and it is very easy to upload data to it without having any firewalls or monitoring systems see anything suspicious or unusual” Neray says. All data stored in DropBox is also encrypted.

The malware itself is stored on a free web hosting service, which makes it harder to track the threat actors behind it. In contrast, the operators of Groundbait hosted their malware on a command and control server on a domain they had created thereby giving investigators a way to get clues to their identity from the registration details.

Operation BugDrop also employs a sophisticated malware detection evasion technique known as Reflective DLL Injection to inject malicious code on victim systems, Neray says. The method involves loading malicious code into memory without calling the usual Windows API call so as to bypass security verification of the code. The same approach was used in the BlackEnergy campaign on Ukraine’s electric grid, and in Stuxnet attacks in Iran, he noted.

Another pointer to the sophistication and resources available to the operators of BugDrop comes from the amount and type of data being collected and presumably analyzed.  At least 2 GB to 3 GB of unstructured data are being uploaded to the DropBox accounts daily.

This means the operators of BugDrop must have a sizeable infrastructure for storing and decrypting the data and access to skilled human analysts for extracting value from the data, Neray says.  “If you think about it, this is not like credit card data,” he says. “You need to have human analysts to look at the data.”

The organizational and logistical planning required for analyzing unstructured data at this scale daily suggests nation-state level capabilities he says.

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Devastating Cyberattack on Email Provider Destroys 18 Years of Data
Jai Vijayan, Freelance writer,  2/12/2019
Up to 100,000 Reported Affected in Landmark White Data Breach
Kelly Sheridan, Staff Editor, Dark Reading,  2/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-1695
PUBLISHED: 2019-02-15
IBM QRadar SIEM 7.2 and 7.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 134177.
CVE-2018-1701
PUBLISHED: 2019-02-15
IBM InfoSphere Information Server 11.7 could allow an authenciated user under specialized conditions to inject commands into the installation process that would execute on the WebSphere Application Server. IBM X-Force ID: 145970.
CVE-2018-1727
PUBLISHED: 2019-02-15
IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 147630.
CVE-2018-1895
PUBLISHED: 2019-02-15
IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ...
CVE-2019-4059
PUBLISHED: 2019-02-15
IBM Rational ClearCase 1.0.0.0 GIT connector does not sufficiently protect the document database password. An attacker could obtain the password and gain unauthorized access to the document database. IBM X-Force ID: 156583.