Vulnerabilities / Threats // Advanced Threats
7/7/2014
06:30 PM
Tim Wilson
Tim Wilson
Quick Hits
50%
50%

Chinese Attackers Targeting U.S. Think Tanks, Researchers Say

Government-backed group "Deep Panda" compromised "several" nonprofit national security policy research organizations, CrowdStrike says

The Chinese cyber attack group Deep Panda late last month compromised "several" national security think tanks with multiple, simultaneous, and sophisticated attacks designed to collect information about foreign policy decisions, according to researchers at security firm CrowdStrike.

Deep Panda, a group that has been attacking targets in the high-tech, financial services, and government arenas since 2009, was found to be cracking think tank systems to collect data on national security policy related to southeast Asia and the Middle East -- two areas where international disputes heightened in June. CrowdStrike officials declined to name the think tanks or the exact details of the data that was compromised, but the attackers breached email, directories and files, they said.

Deep Panda had been collecting information primarily on U.S. policy in southeast Asia, but suddenly shifted direction and began collecting data about Iraq and Middle East policy, according to a blog posted on the CrowdStrike site this afternoon.

"This is undoubtedly related to the recent Islamic State of Iraq and the Levant (ISIS) takeover of major parts of Iraq, and the potential disruption for major Chinese oil interests in that country," the blog says. "In fact, Iraq happens to be the fifth-largest source of crude oil imports for China and the country is the largest foreign investor in Iraq’s oil sector. Thus, it wouldn’t be surprising if the Chinese government is highly interested in getting a better sense of the possibility of deeper U.S. military involvement that could help protect the Chinese oil infrastructure in Iraq. In fact, the shift in targeting of Iraq policy individuals occurred on June 18, the day that ISIS began its attack on the Baiji oil refinery."

The attacks were sophisticated, exploiting a vulnerability in Windows which allowed the group to deploy powershell scripts as scheduled tasks on Microsoft Windows machines, according to CrowdStrike. "The scripts are passed to the powershell interpreter through the command line to avoid placement of extraneous files on the victim machine that could potentially trigger AV- or Indicator of Compromise (IOC)-based detection," the blog states.

"This particular group makes a lot of attacks through a Web exploit or SQL injection, which is followed by in-memory and command line exploits that are difficult to detect because they don't leave artifacts behind," says Adam Meyers, vice president of intelligence at CrowdStrike. "This is a tactic that they will probably continue to use because it works well for them."

CrowdStrike was able to detect the attacks through its Falcon Host software, an agent that collects security information from each endpoint and correlates it with threat data that the company collects from other endpoints. CrowdStrike provides its software to a number of think tanks and human rights organizations on a pro bono basis, because they are nonprofit organizations but are frequent targets of cyber espionage, Meyers says.

The think tanks are "well into the cleanup" of the compromises and are taking steps to prevent future similar attacks, Meyers states. However, it is likely that Deep Panda will continue to target such organizations, he says.

"These think tanks often employ ex-government people who have great contacts and are well connected with foreign governments," Meyers notes. "They are a great source of policy data and I don't think Deep Panda will stop targeting them anytime soon."

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5208
Published: 2014-12-22
BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.00 and R5.x through R5.04.00, and Exaopc through R3.72.10, does not require authentication, which allows remote attackers to read arbitrary files via a RETR operation, write to arbit...

CVE-2014-7286
Published: 2014-12-22
Buffer overflow in AClient in Symantec Deployment Solution 6.9 and earlier on Windows XP and Server 2003 allows local users to gain privileges via unspecified vectors.

CVE-2014-8015
Published: 2014-12-22
The Sponsor Portal in Cisco Identity Services Engine (ISE) allows remote authenticated users to obtain access to an arbitrary sponsor's guest account via a modified HTTP request, aka Bug ID CSCur64400.

CVE-2014-8017
Published: 2014-12-22
The periodic-backup feature in Cisco Identity Services Engine (ISE) allows remote attackers to discover backup-encryption passwords via a crafted request that triggers inclusion of a password in a reply, aka Bug ID CSCur41673.

CVE-2014-8018
Published: 2014-12-22
Multiple cross-site scripting (XSS) vulnerabilities in Business Voice Services Manager (BVSM) pages in the Application Software in Cisco Unified Communications Domain Manager 8 allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCur19651, CSCur18555, CSCur1...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.