Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

2/24/2015
10:45 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
100%
0%

Cybercrime, Cyber Espionage Tactics Converge

Real-world cyberattack investigations by incident response firm Mandiant highlight how hackers are adapting to better achieve their goals.

To get a sense of just how nation-state attackers are upping their game now, consider this: nearly 80% of phishing emails used in attacks investigated by incident response firm Mandiant last year used IT and security-related topics, or impersonation of those departments or antivirus vendors in order to lure their victims into opening malware-laden attachments and links.

That's a 34% increase since 2013, says Ryan Kazanciyan, technical director at Mandiant, a FireEye company, which today published its annual M-Trends Report on investigations it conducted on behalf of breached businesses in 2014. "That's a fairly significant jump. This is one of those things with the visibility you have that represents the totality of what's out there," he says of how nation-states are now crafting their phishes.

Even more telling -- and confounding for investigators -- is how nation-states are increasingly trying to mask their activity in compromised organizations' networks by using hacking tools typically associated with cybercriminals. Mandiant says there's an increasing blurring of lines between the typical earmarks of a nation-state attack and a financially motivated cybercrime one. "A larger number of areas are a gray area now," Kazanciyan says. "Attackers are adapting their approach to [use tools used] in cybercrime," for example.

Mandiant points to the so-called Sandworm nation-state group's use of the BlackEnergy Trojan as a key example of this shift. Sandworm, which has ties to Russia, has targeted victims in Ukraine with BlackEnergy, as well as against ICS/SCADA networks. Why BlackEnergy? "Using crimeware toolkits such as BlackEnergy in those efforts may provide those attackers a degree of anonymity and plausible deniability," Mandiant's report says.

Kurt Baumgartner, principal security researcher for Kaspersky Lab's global research and analysis team, has spotted four new BlackEnergy plug-in tools created by the Sandworm attack group. The attackers are basically hiding behind the notorious and pervasive cybercrime malware. If an organization is running a sandbox and spots the BlackEnergy malware, it will assume crimeware, not Sandworm, he says.

"You wouldn't suspect it was an APT," just crimeware, says Baumgartner, and miss what was really going on in the attack. "They [Sandworm] are careful how they deploy those plugins, so maintain existence under the radar."

Baumgartner and fellow Kaspersky researcher Maria Garnaeva last week at the Kaspersky Security Analyst Summit in Cancun detailed their latest findings with Sandworm's use of BlackEnergy. Among them was a USB plug-in that Baumgartner says appears to be under development by the attackers. The plug-in would allow an attacker to deliver the malware to an air-gapped system, such as an industrial control system, he says.

"[This] is the start of their implementation. It's not deployed anywhere," he says. "It was compiled, but has yet to be delivered to any victims."

The problem with misidentifying the type of attacker that has infiltrated an organization is that it could hamper the proper incident response, according to Mandiant's report, namely that "stolen personal data in the hands of cyber criminals may require a different response—and have a more immediate impact—than data falling into the hands of a nation-state threat group with other, murkier uses for it."

As more high-profile companies are hit with very public breaches--think Target, Home Depot, Sony, and Anthem--everyone wants to know whodunit, but pinning down the true identity of the attacker or attack group is getting more and more complicated.

"There's more pressure than ever to release attribution. People want to know whodunit, even if [the victim company doesn't] have that information yet. And it's getting harder and harder to attribute accurately. We struggle with it quite a bit," says Kazanciyan, who has worked on such high-profile cases as Sony.

And there are often multiple attacks and attack groups infiltrating an organization at one time. More than a quarter of all enterprise cyberattacks that Mandiant investigates end up involving more than one attack group, according to Kazanciyan. "That's not at all uncommon with major investigations in corporations," he says. Some of these are remnants from previous attacks, he says.

Case in point: one organization that Mandiant assisted post-breach had not known about an attack that had happened some eight years before. "There were dormant artifacts from a previous compromise" we found, he says. "That just means that at some point, they were compromised by this other threat group, and that was the residual" evidence, he says.

Much of older cyberattack remnants Mandiant finds are benign leftovers from a data theft, for instance, he says. "A file we picked up sitting on a server left on a machine … trying to call out to a command-and-control server that no longer exists."

Cybercrime Copying Nation-State

Meanwhile, cybercrime groups also are now adopting some techniques used by nation-states, such as more targeted spearphishing emails and Trojan backdoors that provide them a quiet foothold in their target's networks. Take the Carbanak cybercrime ring out of Eastern Europe, which was exposed last week by Kaspersky Lab. The attackers, which have stolen some $1 billion from more than 100 banks across 30 countries, initially went after bank employees with clever phishing emails. They also employ a Trojan based on Carberp that spies, steals data, and gives them remote access to infected machines.

Among the most interesting techniques used by the Carbanak group was video surveillance--that way, they were able to study and ultimately impersonate a bank clerk transferring money so as not to draw attention. That's a far cry from the smash-and-grab methods typically associated with cybercrime attacks.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
2/25/2015 | 11:51:22 AM
Re: Good coverage of useful data points as usual, but...
Hi there, Stephen. Thanks so much for sharing your thoughts. I thought Ryan Kazanciyan of Mandiant did a good job in my interview with him providing a measured analysis of the data & the report. I completely agree with your point that we only know what we know about the real attacks and groups out there. Reports like Mandiant's are really helpful in providing a good snapshot of the attacks/groups they are seeing in their breach investigation cases. But as you note, they are one org's perspective. 
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
2/25/2015 | 11:06:50 AM
compounding the problem...
Good stuff, Kelly! Attribution is extra complicated by the fact that these tactics are converging, and compounding the problem is the fact that the nature of the criminals themselves are changing. For the longest time, any time people said "Chinese hackers," the assumption was that they were backed by or working for the government. Now we know that there are financially motivated hacking groups in China that probably have nothing to do with the nation-state.
zcobb01
100%
0%
zcobb01,
User Rank: Apprentice
2/25/2015 | 2:51:59 AM
Good coverage of useful data points as usual, but...
I appreciate your coverage of these observations Kelly -- would that other journalists knew this subject area as wel as you do -- yet I worry that the lack of solid data on the true nature and extent of both cyber crime and cyber espionage is even greater than we acknowledge.

Useful as reports based on investigated incidents are, they are just that: the incidents seen by a specific entity, or group of entities in the case of the much anticipated Verizon DBIR. They can tell us some important things, but generalizing from them is fraught with danger, as is the urge to treat them as longitudinal studies.

To be fair to the authors of many of these studies, they include statistical disclaimers. But I think all of us are tempted to say things like "there were X% more of attack type Y this year than last" without including the qualifying factors (like "among cases that happened to be brought to our attention", as opposed to "as experienced by the same sample of organizations that we polled last year"). 

I really appreciated Mandant sharing their encounter "dormant artifacts from a previous compromise". That tells us we didn't have a complete picture before. I doubt we have one now.

Stephen Cobb
How Attackers Infiltrate the Supply Chain & What to Do About It
Shay Nahari, Head of Red-Team Services at CyberArk,  7/16/2019
US Mayors Commit to Just Saying No to Ransomware
Robert Lemos, Contributing Writer,  7/16/2019
The Problem with Proprietary Testing: NSS Labs vs. CrowdStrike
Brian Monkman, Executive Director at NetSecOPEN,  7/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12551
PUBLISHED: 2019-07-22
In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the Memcpy function (provided by the scripting engine) allows an attacker to overwrite arbitrary memory, which could lead to code execution.
CVE-2019-12552
PUBLISHED: 2019-07-22
In SweetScape 010 Editor 9.0.1, an integer overflow during the initialization of variables could allow an attacker to cause a denial of service.
CVE-2019-3414
PUBLISHED: 2019-07-22
All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invokes the security management to obtain the resources of the specified operation code owned by a user, the malicious script code could be transmitted in the parameter. If the front en...
CVE-2019-10102
PUBLISHED: 2019-07-22
tcpdump.org tcpdump 4.9.2 is affected by: CWE-126: Buffer Over-read. The impact is: May expose Saved Frame Pointer, Return Address etc. on stack. The component is: line 234: "ND_PRINT((ndo, "%s", buf));", in function named "print_prefix", in "print-hncp.c". Th...
CVE-2019-10102
PUBLISHED: 2019-07-22
aubio 0.4.8 and earlier is affected by: null pointer. The impact is: crash. The component is: filterbank. The attack vector is: pass invalid arguments to new_aubio_filterbank. The fixed version is: after commit eda95c9c22b4f0b466ae94c4708765eaae6e709e.