Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.
Latest cyber-espionage tactics: complexity and modularity versus functionality
Posted on 12-Mar-2015 10:03 | Tags Filed under: News



Nation-state sponsored cyber-espionage attacks are becoming more sophisticated, targeting carefully defined users with complex, modular tools, and keeping well under the radar of increasingly effective detection systems, Kaspersky Lab experts reveal.

This new trend was confirmed during a detailed analysis of the EquationDrug cyber-espionage platform - the main espionage platform developed by the Equation Group.  Kaspersky Lab specialists found that, following the industry’s growing success in exposing Advanced Persistent Threat (APT) groups, the most sophisticated threat actors now focus on increasing the number of components in their malicious platform in order to reduce their visibility and enhance stealth.

The latest platforms now carry many plugin modules that allow them to select and perform a wide range of different functions, depending on their target victim and information they hold. Kaspersky Lab estimates that EquationDrug includes 116 different plugins.

“Nation-state attackers are looking to create more stable, invisible, reliable and universal cyber-espionage tools. They are focused on creating frameworks for wrapping such code into something that can be customised on live systems and provide a reliable way to store all components and data in encrypted form, inaccessible to regular users,” explains Costin Raiu, Director of Kaspersky Lab’s Global Research and Analysis Team.

“Sophistication of the framework makes this type of actor different from traditional cybercriminals, who prefer to focus on payload and malware capabilities designed for direct financial gains.”

“It may seem unusual that a cyber-espionage platform as powerful as EquationDrug doesn't provide all stealing capability as standard in its malware core. The answer is that they prefer to customise the attack for each one of their victims,” Raiu said.

“Only if they have chosen to actively monitor you and the security products on your machines have been disarmed, will you receive a plugin for the live tracking of your conversations or other specific functions related to your activities. We believe modularity and customisation will become a unique trademark of nation-state attackers in the future.”

Other ways in which nation-state attackers differentiate their tactics from traditional cybercriminals include: 

 

  • Scale. Traditional cybercriminals mass-distribute emails with malicious attachments or infect websites on a large scale, while nation-state actors prefer highly targeted, surgical strikes, infecting just a handful of selected users. 
  • Individual approach. While traditional cybercriminals typically reuse publicly available source code such as that of the infamous Zeus or Carberb Trojans, nation-state actors build unique, customised malware, and even implement restrictions that prevent decryption and execution outside of the target computer. 
  • Extracting valuable information. Cybercriminals in general attempt to infect as many users as possible. However they lack the time and storage space to manually check all the machines they infect and to analyse who owns them, what data is stored on them and what software they run. 
    • As a result, they code all-in-one malware stealers that will extract only the most valuable data such as passwords and credit card numbers from victims’ machines – activity that could quickly bring them to the attention of any security software installed. 
    • Nation-state attackers on the other hand have the resources to store as much data as they want. To escape attention and remain invisible to security software they try to avoid infecting random users and instead rely on a generic remote system management tool that can copy any information they might need and in any volumes.  This could, however, work against them as moving a large volume of data could slow down the network connection and arouse suspicion.

EquationDrug has been in use for more than a decade although it is now largely being replaced by the even more sophisticated GrayFish platform. The tactical trends confirmed by the analysis of EquationDrug were first observed by Kaspersky Lab during its research into the cyber-espionage campaigns Careto and Regin, among others.

Kaspersky Lab products detected a number of attempts to attack its users with exploits used by the Equation group in their malware. Many of these attacks were not successful due to Automatic Exploit Prevention technology which generically detects and blocks exploitation of unknown vulnerabilities. The Fanny worm presumably compiled in July 2008 and being a part of the Equation platform, was first detected and blacklisted by our automatic systems in December 2008.

 

 

 



More information: http://Securelist.com...

comments powered by Disqus




Trending now »

Hot discussions in our forums right now:

The President Of The USA: Donald Trump
Created by TimA, last reply by Pumpedd on 19-Feb-2017 21:21 (3046 replies)
Pages... 202 203 204


Shameful politics, shameless politicians
Created by Rikkitic, last reply by dickytim on 20-Feb-2017 06:51 (97 replies)
Pages... 5 6 7


Upgrade Home Wifi Network
Created by Dulouz, last reply by michaelmurfy on 19-Feb-2017 13:36 (14 replies)

Anyone went from a dSLR to mirrorless for most of your photography?
Created by rayonline, last reply by Camden on 17-Feb-2017 22:02 (10 replies)

AntiVirus - If I have a choice?
Created by jackyleunght2002, last reply by Lias on 16-Feb-2017 17:48 (30 replies)
Pages... 2


Lenovo NZ absolutely awful, or is it me?
Created by surfisup1000, last reply by muttley68 on 18-Feb-2017 11:05 (37 replies)
Pages... 2 3


Vodafone you've done it again - John Reader (johnr) is leaving
Created by thecatsgoolies, last reply by DeepBlueSky on 16-Feb-2017 15:29 (72 replies)
Pages... 3 4 5


Best glue for plastic-plastic? (rough edges, ignore cosmetics)
Created by joker97, last reply by Lastman on 19-Feb-2017 22:18 (33 replies)
Pages... 2 3