Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

10:45 AM
Connect Directly

Cybercrime, Cyber Espionage Tactics Converge

Real-world cyberattack investigations by incident response firm Mandiant highlight how hackers are adapting to better achieve their goals.

To get a sense of just how nation-state attackers are upping their game now, consider this: nearly 80% of phishing emails used in attacks investigated by incident response firm Mandiant last year used IT and security-related topics, or impersonation of those departments or antivirus vendors in order to lure their victims into opening malware-laden attachments and links.

That's a 34% increase since 2013, says Ryan Kazanciyan, technical director at Mandiant, a FireEye company, which today published its annual M-Trends Report on investigations it conducted on behalf of breached businesses in 2014. "That's a fairly significant jump. This is one of those things with the visibility you have that represents the totality of what's out there," he says of how nation-states are now crafting their phishes.

Even more telling -- and confounding for investigators -- is how nation-states are increasingly trying to mask their activity in compromised organizations' networks by using hacking tools typically associated with cybercriminals. Mandiant says there's an increasing blurring of lines between the typical earmarks of a nation-state attack and a financially motivated cybercrime one. "A larger number of areas are a gray area now," Kazanciyan says. "Attackers are adapting their approach to [use tools used] in cybercrime," for example.

Mandiant points to the so-called Sandworm nation-state group's use of the BlackEnergy Trojan as a key example of this shift. Sandworm, which has ties to Russia, has targeted victims in Ukraine with BlackEnergy, as well as against ICS/SCADA networks. Why BlackEnergy? "Using crimeware toolkits such as BlackEnergy in those efforts may provide those attackers a degree of anonymity and plausible deniability," Mandiant's report says.

Kurt Baumgartner, principal security researcher for Kaspersky Lab's global research and analysis team, has spotted four new BlackEnergy plug-in tools created by the Sandworm attack group. The attackers are basically hiding behind the notorious and pervasive cybercrime malware. If an organization is running a sandbox and spots the BlackEnergy malware, it will assume crimeware, not Sandworm, he says.

"You wouldn't suspect it was an APT," just crimeware, says Baumgartner, and miss what was really going on in the attack. "They [Sandworm] are careful how they deploy those plugins, so maintain existence under the radar."

Baumgartner and fellow Kaspersky researcher Maria Garnaeva last week at the Kaspersky Security Analyst Summit in Cancun detailed their latest findings with Sandworm's use of BlackEnergy. Among them was a USB plug-in that Baumgartner says appears to be under development by the attackers. The plug-in would allow an attacker to deliver the malware to an air-gapped system, such as an industrial control system, he says.

"[This] is the start of their implementation. It's not deployed anywhere," he says. "It was compiled, but has yet to be delivered to any victims."

The problem with misidentifying the type of attacker that has infiltrated an organization is that it could hamper the proper incident response, according to Mandiant's report, namely that "stolen personal data in the hands of cyber criminals may require a different response—and have a more immediate impact—than data falling into the hands of a nation-state threat group with other, murkier uses for it."

As more high-profile companies are hit with very public breaches--think Target, Home Depot, Sony, and Anthem--everyone wants to know whodunit, but pinning down the true identity of the attacker or attack group is getting more and more complicated.

"There's more pressure than ever to release attribution. People want to know whodunit, even if [the victim company doesn't] have that information yet. And it's getting harder and harder to attribute accurately. We struggle with it quite a bit," says Kazanciyan, who has worked on such high-profile cases as Sony.

And there are often multiple attacks and attack groups infiltrating an organization at one time. More than a quarter of all enterprise cyberattacks that Mandiant investigates end up involving more than one attack group, according to Kazanciyan. "That's not at all uncommon with major investigations in corporations," he says. Some of these are remnants from previous attacks, he says.

Case in point: one organization that Mandiant assisted post-breach had not known about an attack that had happened some eight years before. "There were dormant artifacts from a previous compromise" we found, he says. "That just means that at some point, they were compromised by this other threat group, and that was the residual" evidence, he says.

Much of older cyberattack remnants Mandiant finds are benign leftovers from a data theft, for instance, he says. "A file we picked up sitting on a server left on a machine … trying to call out to a command-and-control server that no longer exists."

Cybercrime Copying Nation-State

Meanwhile, cybercrime groups also are now adopting some techniques used by nation-states, such as more targeted spearphishing emails and Trojan backdoors that provide them a quiet foothold in their target's networks. Take the Carbanak cybercrime ring out of Eastern Europe, which was exposed last week by Kaspersky Lab. The attackers, which have stolen some $1 billion from more than 100 banks across 30 countries, initially went after bank employees with clever phishing emails. They also employ a Trojan based on Carberp that spies, steals data, and gives them remote access to infected machines.

Among the most interesting techniques used by the Carbanak group was video surveillance--that way, they were able to study and ultimately impersonate a bank clerk transferring money so as not to draw attention. That's a far cry from the smash-and-grab methods typically associated with cybercrime attacks.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
2/25/2015 | 11:51:22 AM
Re: Good coverage of useful data points as usual, but...
Hi there, Stephen. Thanks so much for sharing your thoughts. I thought Ryan Kazanciyan of Mandiant did a good job in my interview with him providing a measured analysis of the data & the report. I completely agree with your point that we only know what we know about the real attacks and groups out there. Reports like Mandiant's are really helpful in providing a good snapshot of the attacks/groups they are seeing in their breach investigation cases. But as you note, they are one org's perspective. 
Sara Peters
Sara Peters,
User Rank: Author
2/25/2015 | 11:06:50 AM
compounding the problem...
Good stuff, Kelly! Attribution is extra complicated by the fact that these tactics are converging, and compounding the problem is the fact that the nature of the criminals themselves are changing. For the longest time, any time people said "Chinese hackers," the assumption was that they were backed by or working for the government. Now we know that there are financially motivated hacking groups in China that probably have nothing to do with the nation-state.
User Rank: Apprentice
2/25/2015 | 2:51:59 AM
Good coverage of useful data points as usual, but...
I appreciate your coverage of these observations Kelly -- would that other journalists knew this subject area as wel as you do -- yet I worry that the lack of solid data on the true nature and extent of both cyber crime and cyber espionage is even greater than we acknowledge.

Useful as reports based on investigated incidents are, they are just that: the incidents seen by a specific entity, or group of entities in the case of the much anticipated Verizon DBIR. They can tell us some important things, but generalizing from them is fraught with danger, as is the urge to treat them as longitudinal studies.

To be fair to the authors of many of these studies, they include statistical disclaimers. But I think all of us are tempted to say things like "there were X% more of attack type Y this year than last" without including the qualifying factors (like "among cases that happened to be brought to our attention", as opposed to "as experienced by the same sample of organizations that we polled last year"). 

I really appreciated Mandant sharing their encounter "dormant artifacts from a previous compromise". That tells us we didn't have a complete picture before. I doubt we have one now.

Stephen Cobb
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-04-13
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated remote code execution vulnerability. IPM software does not sanitize the date provided via coverterCheckList action in meta_driver_srv.js class. Attackers can send a specially crafted packet to make IPM connect to ro...
PUBLISHED: 2021-04-13
SAP NetWeaver AS JAVA (Customer Usage Provisioning Servlet), versions - 7.31, 7.40, 7.50, allows an attacker to read some statistical data like product version, traffic, timestamp etc. because of missing authorization check in the servlet.
PUBLISHED: 2021-04-13
SAP Manufacturing Execution (System Rules), versions - 15.1, 15.2, 15.3, 15.4, allows an authorized attacker to embed malicious code into HTTP parameter and send it to the server because SAP Manufacturing Execution (System Rules) tab does not sufficiently encode some parameters, resulting in Stored ...
PUBLISHED: 2021-04-13
SAP NetWeaver AS Java (Applications based on HTMLB for Java) allows a basic-level authorized attacker to store a malicious file on the server. When a victim tries to open this file, it results in a Cross-Site Scripting (XSS) vulnerability and the attacker can read and modify data. However, the attac...
PUBLISHED: 2021-04-13
SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application. An attacker with this authorization can inject malicious code in the sour...