Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

11/5/2019
02:10 PM
50%
50%

Disclosure Does Little to Dissuade Cyber Spies

In the past, outing nation-state cyber espionage groups caused a few to close up shop, but nowadays actors are more likely to switch to new infrastructure and continue operations.

When cybersecurity services firm Mandiant released its APT 1 report in 2013, the Chinese group immediately shut down, and the command-and-control servers that had been used by the group to manage its infrastructure went quiet. 

The incident has driven a naming-and-shaming policy pursued by the United States, which has filed indictments against a number of cyber-espionage actors in Russia, China, and Iran. However, such tactics increasingly appear to fail to have the intended effect, according to a report planning to be published on Nov. 5 by defense giant BAE Systems. While an Iranian group, which BAE Systems calls Operation Cleaver, ceased operations following a report in late 2014, many other Iranian groups continued to operate, including Team Ajax, Shamoon, and others, the analysis said.

It is clear that the Operation Cleaver report just led to a retasking of resources, BAE Systems' analysts concluded in the report.

"A leading theory for the group's disappearance is that Operation Cleaver splintered, and the members dispersed and/or restructured, spent nearly a year retooling and reorganizing, and returned in autumn 2015 as OilRig. However, this remains unconfirmed," the analysis stated. "What is more clear is that Iranian operations which targeted aerospace, defence, and energy didn’t entirely disappear but re-emerged around the same time as OilRig and continued with similar tasking."

The analysis of cyber-espionage groups' activities following being outed by security researchers, government agencies, and non-government organizations (NGOs) does not come to any particular conclusion, but it does show that — aside from a few early, and only purported, successes — outing cyber-espionage groups does little to disuade them from future actions. With state-sponsored cyber espionage considered a legitimate political activity, the penalties for being caught are small, says Saher Naumaan, threat intelligence analyst at BAE Systems Applied Intelligence.

"Conducting [these] operations is the new norm, which diminishes the severity of the consequences because it's just what states do now," she says. "The groups don't have to disappear anymore because this is understood to be legitimate espionage activity."

While some early groups have gone quiet, most have changed up their infrastructure. A few have retaliated. Predictably, disclosure of attackers' tactics also led to other groups adopting those same tactics, although linking disclosure with the adoption of techniques is difficult, BAE Systems stated. 

"Disclosure has benefits and drawbacks," the company's researchers stated in the analysis. "The thousands of public blogs and reports made on the activity of the hundreds of threat groups who have been reported on has contributed to a shared 'body of knowledge' which has driven evolution of attack techniques."

The most common strategy for cyberattackers, however, is to change tactics. 

The Chinese group APT10, also known as Stone Panda, had used dynamic DNS infrastructure to carry out attacks against managed service providers (MSPs) — operations that were publicly outed in 2017. While the group stopped using some tools and expanded its infrastructure options, it continued operations. 

"The group became careful and siloed its campaigns based on tools, targets, and infrastructure, which led to increased difficulty in mapping out its operations," BAE Systems stated. "This again shows that threat actors no longer feel obligated to shut down all operations due to disclosure and can adapt to changing circumstances."

Another way that cyber-espionage groups attempt to hide their trails is to adopt the techniques of other nation's cyber spies. In October, for example, the UK's National Cyber Security Center revealed that a Russian-backed group, known as Turla, used attack infrastructure that it apparently stole from an Iranian group known as APT34.

"The timeline of incidents, and the behaviour of Turla in actively scanning for Iranian backdoors, indicates that whilst (the attack) tools were Iranian in origin, Turla were using these tools and accesses independently to further their own intelligence requirements," the NCSC's advisory stated. "The behaviour of Turla in scanning for backdoor shells indicates that whilst they had a significant amount of insight into the Iranian tools, they did not have full knowledge of where they were deployed."

Only rarely do attackers decide to strike back at the disclosers in some way, according to BAE Systems' report. Charming Kitten, also known as APT35, impersonated the security firm ClearSky and one of its researchers after the company outed some details of the group's operations.

In the end, there are still benefits to disclosure, but companies, organizations, and researchers should all consider the consequences, not just to the attacker but to the work of researchers when attackers' methods are disclosed, says Naumaan.

"Our job is to disrupt adversary activity or make it difficult — disclosure forces attackers to improve, which has a cost, [such as] creating new infrastructure, building new tools, etc.," she says. "Disclosure, [however,] has moved away from major releases [and] whitepapers to quick turnaround tweets and simultaneously doesn't have as significant an impact on attackers as it used to."

Related Content:

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Intel Issues Fix for 'Plundervolt' SGX Flaw
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5252
PUBLISHED: 2019-12-14
There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficient authentication in a rare condition. Successful exploit could allow the attacker to use the application locked by applock in an instant.
CVE-2019-5235
PUBLISHED: 2019-12-14
Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal.
CVE-2019-5264
PUBLISHED: 2019-12-13
There is an information disclosure vulnerability in certain Huawei smartphones (Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;Honor 9 Lite;Honor 9i;Mate 9). The software does not properly handle certain information of applications locked by applock in a rare condition...
CVE-2019-5277
PUBLISHED: 2019-12-13
Huawei CloudUSM-EUA V600R006C10;V600R019C00 have an information leak vulnerability. Due to improper configuration, the attacker may cause information leak by successful exploitation.
CVE-2019-5254
PUBLISHED: 2019-12-13
Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981) have an out-of-bounds read vulnerability. An attacker who logs in to the board m...