Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


04:47 PM

The Best Spies Money Can Buy

Security firms have found evidence that espionage agents are buying time on leased botnets: Will cybercriminals services lead to more efficient spying?

During the past decade, cybercriminals have specialized in the various tasks needed to compromise computers, steal data, and make money. Now, more elusive nation-state attackers could be using rented botnets and cybercriminal services to streamline their own operations, security experts say.

In June, security firm FireEye detected evidence of such a connection when it found instances of a remote-access Trojan whose code seemed to have been reused to infect machines with fake antivirus software. In another incident, cybercriminals sold access to compromised military and government computers, allowing would-be cyberspies to get direct access to their targets, says Darien Kindlund, senior staff scientist at FireEye.

The two examples are part of a building body of evidence that suggests attackers representing what the military and security industry refer to as the advanced persistent threat (APT) are not shying away from using criminals' resources to help them in their missions.

"If military and government hosts are being sold on the black market, who are the most likely buyers -- spammers?' No, they could buy something cheaper on a different network. But for APT? 'Yes, it meets their mission objectives," Kindlund says.

Criminals looking to rent time on a botnet will likely try to avoid using military and government servers for fear of more intense repercussions. Yet the same servers are the targets for APT attacks, Kindlund argues. The cybercriminal element on the Internet certainly seems ready to handle sales of botnets to any comer, including espionage agents.

"These malware criminals may not necessarily know that their buyers are APT actors because they provide generic, easy-to-use Web interfaces to allow anyone to 'rent' machine time on compromised systems," Kindlund says.

McAfee acknowledges that buying hacked systems within a targeted company would be an easy way to get behind the company's defenses. Yet the company has not found much evidence of espionage agents using criminal botnets to carry out their missions, says Stuart McClure, general manager for risk compliance at McAfee. Contacting a criminal group to purchase compromised machines carries a large risk of tipping the hand of a spy, he says.

"If I was the bad guy, I would go after the command-and-control servers themselves and just hack those," McClure says. "Then I would figure out which systems the C&Cs had control over, and I would just take over those."

Other security firms also believe the link between cybercriminals and nation-state attackers might be fairly uncommon. Evidence linking code might not mean a common code base, but a common exploit, says Rik Ferguson, director of security research for Trend Micro's Europe, Middle East, and Africa business unit.

"There is very little crossover in terms of the actual Trojan malware used in espionage attacks versus criminal attacks," Ferguson says. "However, there may be crossovers in terms of the vulnerabilities that cause the initial infection."

In the end, it depends on who is trying to steal information. It's unlikely that an intelligence agency will go to the only version of the mob and ask for an informant in a particular company or government office, McAfee's McClure says. Instead, they will create their own tools.

"At the end of the day, if you are a spy agency, you are going to develop your own stuff," he says. ""You may get ideas from others ... but I don't think the elite guys are ever going" to do business with criminals, he says.

Yet,criminals could decide that the market for intellectual property is lucrative enough to make a profit. In that case, all bets are off, FireEye's Kindlund says.

"If we look at the logical conclusion of this trend, we see that eventually different cybercrime groups emerge, each specializing in different stages of the overall 'business' model ... [including] exfiltrated intel sales," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
What the FedEx Logo Taught Me About Cybersecurity
Matt Shea, Head of Federal @ MixMode,  6/4/2021
A View From Inside a Deception
Sara Peters, Senior Editor at Dark Reading,  6/2/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-13
The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.
PUBLISHED: 2021-06-12
Receita Federal IRPF 2021 1.7 allows a man-in-the-middle attack against the update feature.
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
PUBLISHED: 2021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package apport hooks, it could expose private data to other local users.