Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Advanced Threats

6/30/2014
04:30 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Cyberspying Campaign Comes With Sabotage Option

New research from Symantec spots US and Western European energy interests in the bull's eye, but the campaign could encompass more than just utilities.

A well-heeled and aggressive cyber espionage operation out of Eastern Europe is targeting mainly US and other Western energy grid operators, electricity generation firms, and petroleum pipeline operators by planting Trojan-rigged software updates on the websites of the victims' industrial control system (ICS) software vendors.

The attacks on energy industry vendors came to light last week when F-Secure revealed it had spotted the attacks targeting European energy firms. They are the handiwork of a nation-state backed hacking group called DragonFly, a.k.a. Energetic Bear, according to new research on the attacks published today by Symantec. Spain (27%) and the US (24%) were the nations with the most active infections via the attack campaign, followed by France (9%), Italy, Germany, Turkey, Poland, Romania, Greece, and Serbia.

Kevin Haley, director of Symantec Security Response, says the attackers are out of Eastern Europe and have in their arsenal malware that could be used to sabotage or disrupt the operations of their victims. "We have not seen any signs of sabotage." However, "the potential for that is clearly there."

Symantec spotted the group shifting more of its focus on to energy firms as of March, with half the targets in energy and 30% in energy control systems, followed by file hosting services and "unidentified" targets.

But Sean Sullivan, a security adviser at F-Secure, says the attacks -- which he confirms are out of Russia -- are not just about stealing information from or disrupting energy grid operators. "From what I've seen, it looks to me like they want a broad range of targets. The espionage going on here seems to be a wide net for any sort of infrastructure that might give the ability to get your way politically… That fits in with what I know of Russian tactics."

Commercial manufacturing operations are in the bull's eye, as well, he says, especially ones that supply the attackers' potential military adversaries.

[F-Secure has unearthed a new attack against industrial control systems that goes after European targets, using rare infection vectors. Read As Stuxnet Anniversary Approaches, New SCADA Attack Is Discovered.]

Neither F-Secure nor Symantec would name names, but at least three software vendors' websites were hacked, and their software update links were implanted with the so-called Havex or Oldrea backdoor Trojan, a custom remote access Trojan that fingerprints computers and other systems in a victim's network, including specific server information. ICS-CERT reports in its advisory on these attacks that the Havex malware can trigger intermittent denial-of-service attacks on ICS applications.

According to Symantec, some victim organizations downloaded the malware when updating their ICS software, giving the attackers a foothold into their networks as well as a means to sabotage their operations on those systems. Havex/Oldrea gathers system information, lists of files and programs on the infected machine, and available drives, as well as Outlook address book and VPN configuration information.

Most of the command and control servers are hosted on hijacked content management systems, and the attackers also sometimes employ the Karagany Trojan, which is available in the cybercrime underground market. "Karagany is capable of uploading stolen data, downloading new files, and running executable files on an infected computer," Symantec said in a blog post today. "It is also capable of running additional plugins, such as tools for collecting passwords, taking screenshots, and cataloging documents on infected computers."

The DragonFly/Energetic Bear gang has been in action at least since 2011 and originally focused its efforts on US and Canadian defense and aviation companies, according to Symantec. The traditional approach to attack was spearphishing and later watering hole attacks where it infected websites its targets would most likely visit. Targeting their software vendors was yet another attack vector.

This isn't the first time attackers have used their targets' software vendors as a vector of infection. "We've seen the Hidden Lynx group do similar" things, Haley said. Hidden Lynx was behind the attack on Bit9; attackers stole one of the security vendor's digital code-signing certificates and used it to sign malware in attacks against some of its customers.

"The attackers are collecting logins, passwords… we saw them stealing from Outlook," as well, Haley said.

(Source: Symantec)
(Source: Symantec)

F-Secure's Sullivan said his team has witnessed several connections to the attackers' command and control servers from Tor anonymized nodes. They also saw the attackers using the "Fing" application, which scans and takes inventory of a network. "We think the folks behind this are collecting as much as possible… and seeing what might be useful in soft power deployment."

He worries that the conclusions have been pointing too quickly to an energy sector attack only. "This is a very broad-based" campaign to cripple adversaries, including via manufacturers that supply their armies with food and other crucial items.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
7/3/2014 | 8:39:54 AM
Re: Actions
Thanks! I am always interested to hear about what is done with the data after it is stolen. Some choose to remain silent while others choose to exploit. Reasons tend to vary as to why.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
7/1/2014 | 8:03:17 AM
Re: Actions
No details on what if any damage was done intel-wise, but there weren't any cases of known sabotage that Symantec and F-Secure knew of.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
6/30/2014 | 6:07:48 PM
Actions
I know data has been stolen and software has been hacked on critical infrasture but has there been any word on what is being done with this data? As in, have the attackers acted on the information they have stolen or the functionality in which they have acquired in a detrimental manner? Or did Symantec and F-Secure not comment to that point?
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
US Mayors Commit to Just Saying No to Ransomware
Robert Lemos, Contributing Writer,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2002-0390
PUBLISHED: 2019-07-21
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2002-0639. Reason: This candidate is a reservation duplicate of CVE-2002-0639. Notes: All CVE users should reference CVE-2002-0639 instead of this candidate. All references and descriptions in this candidate have been removed to prevent ...
CVE-2018-17210
PUBLISHED: 2019-07-20
An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. The core components that create and launch a print job do not perform complete verification of the session cookie that is supplied to them. As a result, an attacker with guest/pseudo-guest level permissions can bypass t...
CVE-2019-12934
PUBLISHED: 2019-07-20
An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-js allows CSRF, as demonstrated by an XSS payload in the hljs_additional_css parameter.
CVE-2019-9229
PUBLISHED: 2019-07-20
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.251. An internal interface exposed to the link-local address 169.254.254.253 allows attackers in the local network to access multiple quagga VTYs. Attackers can...
CVE-2019-12815
PUBLISHED: 2019-07-19
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.