News Threat Intelligence
Aurora, Other Zero-Day Attacks Linked In 'Elderwood' Study
Series of sophisticated attacks could be driven by organized crime or a nation state, Symantec says
The infamous Aurora Trojan horse is just one of many attacks launched by the same group of malware authors over the past three years, according to researchers at Symantec.
In a reportposted earlier this week, the researchers link a series of attacks that re-use components of an infrastructure they call the "Elderwood Platform." The attack platform enables the malware authors to quickly deploy zero-day exploits, according to the report.
More Security Insights
White Papers
- The Power of Cloud: Driving Business Model Innovation
- Digital Transformation: Creating new business models where digital meets physical
Reports
- Strategy: How Cybercriminals Choose Their Targets and Tactics
- Strategy: Cybersecurity on the Offense
Webcasts
- Mobile DevOps: Achieving continuous delivery with multiple front ends and complex backends in Banking, Financial Services, and Insurance
- How Cloud Facilitates an Agile Contact Center
"Serious zero-day vulnerabilities, which are exploited in the wild and affect a widely used piece of software, are relatively rare; there were approximately eight in 2011," the researchers say. "The past few months, however, has seen four such zero-day vulnerabilities used by the Elderwood attackers...we have seen no other group use so many. The group seemingly has an unlimited supply of zero-day vulnerabilities."
The primary targets of these attacks are usually members of the defense supply chain, the Symantec researchers say. "These are companies who manufacture electronic or mechanical components that are sold to top-tier defense companies. The attackers do so expecting weaker security postures in these lower-tier organizations, and may use these manufacturers as a stepping-stone to gain access to top-tier defense contractors."
The long-term reuse of components, the frequent use of zero-day exploits, and the sophistication of the attacks all point to a stable and skilled group of malware authors, probably supported by organized crime or a nation state, the researchers say.
Have a comment on this story? Please click "Add a Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.
Related Reading
Dark Reading Discussions
Start the Discussion
 |
To upload an avatar photo, first complete your Disqus profile. | View the list of supported HTML tags you can use to style comments. | Please read our commenting policy. |
