Threat Intelligence
01:20 PM
Connect Directly

Sony Hackers Still Active, Darkhotel Checks Out Of Hotel Hacking

How some cyber espionage and other advanced attack groups don't go dark anymore after being outed.

The epic and ugly cyberattack on Sony in 2014 may now be one for the history books, but the attackers behind it remain active and prolific.

“They didn’t disappear when the dust settled” after the Sony attacks, says Juan Andres Guerrero-Saade, senior security researcher at Kaspersky Lab. Guerrero-Saade and fellow researcher Jaime Blasco last week at the Kaspersky Security Analyst Summit in Tenerife, Spain, detailed new activity by the Sony hackers.

“It took us two years to correlate all of the information we had  … The same people were launching campaigns using information from the Sony attack,” said Blasco, who is vice president and chief scientist of AlienVault. The attacks are mainly intelligence-gathering efforts, but occasionally the attacks include wiping disk drives, he said.

The attackers, which the US government say came out of North Korea, pummeled Sony, wiping disk drives, and doxing emails and other sensitive information.

There has been a noticeable shift in how some advanced threat groups such as this respond after being publicly outed by security researchers. Historically, cyber espionage gangs would go dark. “They would immediately shut down their infrastructure when they were reported on,” said Kurt Baumgartner, principal security researcher with Kaspersky Lab. “You just didn’t see the return of an actor sometimes for years at a time.”

But Baumgartner says he’s seen a dramatic shift in the past few years in how these groups react to publicity. Take Darkhotel, the Korean-speaking attack group known for hacking into WiFi networks at luxury hotels in order to target corporate and government executives. Darkhotel is no longer waging hotel-targeted attacks -- but they aren’t hiding out, either.

In July, Darkhotel was spotted employing a zero-day Adobe Flash exploit pilfered from the HackingTeam breach. “Within 48 hours, they took the Flash exploit down … They left a loosely configured server” exposed, however, he told Dark Reading. “That’s unusual for an APT [advanced persistent threat] group.”

The Darkhotel group appears to care less about its infrastructure and more about its advanced attack techniques, he says. “Public exposure isn’t going to affect them,” he says.

“The hotel [attack] activity focused on business travelers has come to an end, but the other operations are highly active,” including sending rigged links to Southeast Asia targets via Webmail services.

‘No Such Actor’

Meantime, one of the most advanced and infamous nation-state threat actor groups has been dark for more than a year. Kaspersky Lab still hasn’t seen any sign of the so-called Equation Group, the nation-state threat actor operation that the security firm exposed early last year and that fell off its radar screen in January of 2014.

The Equation Group, which has ties to Stuxnet and Flame as well as clues that point to a US connection, was found with advanced tools and techniques including the ability to hack air gapped computers, and to reprogram victims’ hard drives so its malware can’t be detected nor erased. While Kaspersky Lab stopped short of attributing the group to the National Security Agency (NSA), security experts say all signs indicate that the Equation Group equals the NSA.

“I would assume they are active but just changed their” communications, says Costin Raiu, director of the global research and analysis team at Kaspersky Lab. “We don’t detect them anymore.”

Just how APT groups from various regions react to being outed is often a cultural thing. “The Far Eastern [APTs] don’t seem to care too much” about hiding out after being outed, he told Dark Reading. “The rest of the world cares a bit more.”

On exception to that is the attack group behind the US Office of Personnel Management (OPM) breach, he says. “They are different kind of fish. The moment they got discovered,” they shifted gears, he says. “We found traces of activity related to those guys. But it was at another level of skills and capabilities versus other Chinese-speaking groups.”


Related Content:


Interop 2016 Las VegasFind out more about the latest security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

Kelly Jackson Higgins is Executive Editor at She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
According to industry estimates, about a million new IT security jobs will be created in the next two years but there aren't enough skilled professionals to fill them. On top of that, there isn't necessarily a clear path to a career in security. Dark Reading Executive Editor Kelly Jackson Higgins hosts guests Carson Sweet, co-founder and CTO of CloudPassage, which published a shocking study of the security gap in top US undergrad computer science programs, and Rodney Petersen, head of NIST's new National Initiative for Cybersecurity Education.