03:14 PM
Connect Directly

South America the Target of 'Sowbug' Cyber Espionage Group

Diplomatic and government organizations in Brazil, Peru, Ecuador, and Argentina are being targeted by what Symantec says looks like a nation-state actor.

A shadowy threat group with nation-state capabilities has been conducting a sophisticated cyber espionage campaign against government targets in South America, a region where such attacks have been relatively rare.

The group, called Sowbug, has been active since at least early 2015 and appears primarily interested in gathering foreign policy information from diplomatic and government entities in the region, Symantec warned in a report published Tuesday.

The Sowbug group's victims include organizations in Brazil, Peru, Argentina, and Ecuador. In addition to South America, the hacker group has also targeted organizations in Southeast Asia and broken into government organizations in Brunei and Malaysia.

Symantec says it first spotted signs of Sowbug's activity in March 2017 when it discovered a brand new backdoor dubbed Felismus being used against a target in South East Asia. The group appears to be well-resourced and capable of infiltrating multiple targets simultaneously and maintaining a presence on their networks for extended periods. In some cases, they have remained undetected on a victim's network for up to six months.

What makes the Sowbug campaign significant is its focus on South America, says Dick O'Brien, security researcher at Symantec. Typically, most attacks of this nature have been directed at organizations in the United States and Europe. "The most significant thing for us was seeing a group like this targeting South America, which, to date, has been quite rare," O'Brien says. 

"The big takeaway from our perspective is that cyberespionage is now a global issue and no region is unaffected," he says. Organizations shouldn't assume they won't be targeted because of where they are located, and should build their defenses against such threats.

In terms of capabilities, the Sowbug group has developed its own sophisticated malware and seems to have enough personnel to take on multiple targets at the same time. The attackers tend to only operate outside of the normal working hours in their targeted countries to minimize their chances of getting caught. "Therefore, we'd view them as capable and well-resourced attackers, near the elite end of the spectrum," O'Brien says.

The actors behind the Sowbug campaign appear to be looking for very specific information on victim networks. For instance, in a May 2015 attack on the foreign affairs ministry of a South American nation, the attacks seemed focused on extracting documents from a division of the ministry that was responsible for foreign relations with a nation in the Asia-Pacific region.

The threat actors first looked for and extracted all Word documents stored in a file server belonging to the division that had been modified from May 11, 2015. One hour later, they came back to the same server and extracted an additional four days worth of data. "Presumably they either didn't find what they were looking for in the initial incursion, or else noticed something in the documents they stole earlier that prompted them to hunt for more information," Symantec noted in its report.

They then attempted to extract Word documents and other content from remote files shares and shared drives belonging to the targeted division, once again using a very specific date range. In this particular instance, the threat actors from Sowbug managed to remain undetected on the victim network for a period of four months between May and September 2015.

One tactic the group has used to evade detection is to disguise its malware as well-known software packages such as Windows and Adobe Reader. The group has been able to hide in plain sight by naming its tools after well-known software products and placing them in directory trees where they can easily be mistaken for the real thing, according to Symantec.

O'Brien says Symantec so far has not been able to figure out how the group initially infiltrates a target system or drops the Felismus backdoor on them. In some cases, the researchers have seen the attackers employ a dropper dubbed Starloader to install Felismus. But in those cases, the company has not been able to figure out how Sowbug got the dropper on the system.

"We were unable to identify any technical or operational aspects of the attack that would indicate possible origin of this activity," O'Brien says. "However, we can say the targets are likely of interest to a nation-state and the malware used in these attacks is at the level of sophistication we would expect to see with state-sponsored attackers."

Related content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Who Does What in Cybersecurity at the C-Level
Steve Zurier, Freelance Writer,  3/16/2018
New 'Mac-A-Mal' Tool Automates Mac Malware Hunting & Analysis
Kelly Jackson Higgins, Executive Editor at Dark Reading,  3/14/2018
Microsoft Report Details Different Forms of Cryptominers
Kelly Sheridan, Staff Editor, Dark Reading,  3/13/2018
Register for Dark Reading Newsletters
White Papers
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.