Information Security News mailing list archives
'Time Bomb' Attack Out Of China Defused
From: InfoSec News <alerts () infosecnews org>
Date: Thu, 7 Mar 2013 00:37:15 -0600 (CST)
http://www.darkreading.com/threat-intelligence/167901121/security/attacks-breaches/240150216/time-bomb-attack-out-of-china-defused.html By Kelly Jackson Higgins Dark Reading Mar 06, 2013Mandiant's in-depth report published last month on a prolific cyberespionage team tied to the Chinese military was, in turn, used as a lure in other targeted attacks -- by what appears to be different Chinese hacker groups.
The attacks, spotted by Seculert, used a phony version of the report as a lure in a spearphishing attack against Japanese and Chinese journalists. The targeted attack against the Japanese victims came with an interesting twist: a "time bomb" element, according to Aviv Raff, CTO at Seculert.
Mandiant's report calls out the People's Liberation Army Unit 61398 as the APT1 group responsible for cyberspying against multiple industries.
The malware used in the attacks on Japanese journalists was programmed to trigger during 8 a.m. and 7 p.m. only, according to Raff. Raff says aside from the malware communicating with legitimate Japanese websites, it also came with another command-and-control domain in memory, one that was registered to a free dynamic DNS server and went to a Korea-based IP address.
During the programmed time frame, the malware would communicate with "the real C2 server," he says, rather than the legit Japanese websites. It also would then download additional malware.
[...] ______________________________________________ Visit the InfoSec News Security Bookstore Best Selling Security Books and More!http://www.shopinfosecnews.org
Current thread:
- 'Time Bomb' Attack Out Of China Defused InfoSec News (Mar 06)