Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

2/23/2016
06:00 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Operation Dust Storm Hackers Set Sights On Japan's Critical Infrastructure

Japanese energy, oil/gas, and transportation industries the target of stealthy, patient cyber-espionage group.

A threat group that has attacked a variety of targets including US defense agencies since 2010, has recently zeroed in all efforts on Japanese critical infrastructure. Though they have not yet been "destructive or disruptive," the cyber espionage group has been quietly, persistently lurking within Japan's power, oil/gas, construction, finance, and transportation industries, according to researchers at the Cylance SPEAR Team.

Dubbed Operation Dust Storm by researchers, the attackers' tools of choice are mostly second-stage backdoors and their activities are related to current events. In 2011, early in the group's evolution, they targeted the US defense sector by using phishing lures related to the death of Libyan Prime Minister Muammar Gaddafi. More recently, in 2015, group compromised investment arm of a Japanese automaker, implanting a second-stage backdoor (via an existing backdoor) two weeks before 11 Japanese autoworker unions demanded a monthly raise of 6,000 yen.

Their goals thusfar appear to be reconaissance and long-term espionage. "At this time, SPEAR does not believe the attacks were meant to be destructive or disruptive," according to the report. "However, our team believes that attacks of this nature on companies involved in Japanese critical infrastructure and resources are ongoing and are likely to continue to escalate in the future."

The group has managed to maintain persistence and stay under the radar, by registering new domain names, taking advantage of dynamic DNS, and using a variety of customized backdoors -- particularly second-stage backdoors with hard-coded proxy addresses and credentials, as well as Android backdoors. Their mobile malware initially only forwarded SMS and call data to command-and-control servers, then added the ability to enumerate and exfiltrate specific files from devices. Those efforts to stay ahead of security tools have been largely successful.

According to the report: "No antivirus vendors seem to reliably detect most of the variants SPEAR identified."

 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MoviePass Leaves Credit Card Numbers, Personal Data Exposed Online
Kelly Sheridan, Staff Editor, Dark Reading,  8/21/2019
New FISMA Report Shows Progress, Gaps in Federal Cybersecurity
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/21/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13139
PUBLISHED: 2019-08-22
In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be able to gain command execution. An issue exists in the way "docker build" processes remote git URLs, and results in command injection into the ...
CVE-2019-15325
PUBLISHED: 2019-08-22
In GalliumOS 3.0, CONFIG_SECURITY_YAMA is disabled but /etc/sysctl.d/10-ptrace.conf tries to set /proc/sys/kernel/yama/ptrace_scope to 1, which might increase risk because of the appearance that a protection mechanism is present when actually it is not.
CVE-2019-15326
PUBLISHED: 2019-08-22
The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.
CVE-2019-15327
PUBLISHED: 2019-08-22
The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.
CVE-2019-15328
PUBLISHED: 2019-08-22
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.