Security company FireEye collected evidences of a cyber espionage campaign, named "Sanny",
attributable to Korea. FireEye hasn’t revealed the real origin of the
offensive, it’s a mystery which Korea is responsible between North
or South Korea, but it confirmed that 80% of victims are Russian
organizations and companies belonging to space research industry,
information, education and telecommunication.
According Ali Islam, security researcher at FireEye declared “Though
we don’t have full concrete evidence, we have identified many
indicators leading to Korea as a possible origin of attack."
The following are the indicators we have so far:
1. The SMTP mail server and CnC are in Korea
2. The fonts "Batang" and "KP CheongPong" used in the document are Korean
3.
The fact that the attacker chose a Korean message board as the CnC
shows that either he/she is a native speaker or is at least very
comfortable with the Korean language
4. Some searching on "jbaksanny" (the Yahoo email used) leads to a Korean Wikipedia page
created by the user named Jbaksan. The page is auto-filled and has
nothing in the edit history except the creation of this user.
The unique certainly seems to be that experts have detected a state-sponsored attack and that the attackers have demonstrated great cyber capabilities.
Ali Islam added "Once you
have that information, you have access to employees' emails even from
outside, and that means a lot of official information," Islam says. "It also steals other accounts credentials, all user passwords stored by Firefox for auto login."
The
schema of infection is classic, victims received a phishing message
containing a malware hidden in a document, apparently proposing
information related to a meeting of the Association of Southeast Asian
Nations, that exploits a Microsoft Word vulnerability to steal data.
The figure below reports a document written with Cyrillic character set demonstrating the real targets of attacks.
The figure below reports a document written with Cyrillic character set demonstrating the real targets of attacks.
The most singular characteristic
of the cyber attacks is the use of a public forum to collect the stolen
information, data is sent to the board that does not require
authentication mechanisms that make the victims visible.
Today the C&C server is
still active and the attackers are monitoring it to check new victims
and stolen data every couple of days deleting data once acquired.
Investigations are still ongoing.
| روابط هذه التدوينة قابلة للنسخ واللصق | |
| URL | |
| HTML | |
| BBCode | |
شاهد ايضا اخر مواضيع الجيش العرقي الالكتروني
kamindoz
