Researchers warn of 'hit and run' cyber attackers

Sep 26, 2013
Security researchers said Wednesday they uncovered a "cyber mercenary" team which specializes in attacks on targets in Japan and South Korea, and warned of more operations of that nature.

Security researchers said Wednesday they uncovered a "cyber mercenary" team which specializes in attacks on targets in Japan and South Korea, and warned of more operations of that nature.

Kaspersky Labs identified the group as "Icefog," and said evidence points to it being based in China.

Based on the targets, the attackers appear to have an interest in military, and maritime operations, computers and software, research companies, , , and television.

Kaspersky said the operation was a "small yet energetic Advanced Persistent Threat (APT) group" which focuses on targets involved in the supply chain for Western companies.

The operation started in 2011 and has increased in size and scope over the last few years, according to the report presented at a Washington conference.

The attackers have been "hitting pretty much all types of victims and sectors. In most cases, attackers maintain a foothold in corporate and governmental networks for years, smuggling out terabytes of sensitive information," said Kaspersky researcher Costin Raiu.

"The 'hit and run' nature of the Icefog attacks demonstrate a new emerging trend: smaller hit-and-run gangs that go after information with surgical precision. The attack usually lasts for a few days or weeks and after obtaining what they were looking for, the attackers clean up and leave."

Raiu said these types of hackers-for-hire groups are growing, developing into a "kind of 'cyber mercenary' team for the modern world."

The researchers localized the attackers and "assume some of the players behind this threat operation are based in at least three countries: China, South Korea and Japan," with the largest number in China.

The report, presented at the Billington Cybersecurity Summit, said Icefog targeted attacks relied on spear-phishing e-mails that attempt to trick the victim into opening a malicious attachment or a website.

Some of these attachments include images of scantily clad women or "decoy" documents; when users click on the attachments, they unwittingly install malicious software which allows access to the attackers.

"The attackers are hijacking sensitive documents and company plans, e-mail account credentials, and passwords to access various resources inside and outside the victim's network," a Kaspersky statement said.

"In most cases, the Icefog operators appear to already know very well what they need from the victims. They look for specific file names, which are identified and transferred" to the attackers.

Explore further: Twitter admits to diversity problem in workforce

add to favorites email to friend print save as pdf

Related Stories

'Phishing' scams explode worldwide, researchers shows

Jun 21, 2013

Those insidious email scams known as phishing, in which a hacker uses a disguised address to get an Internet user to install malware, rose 87 percent worldwide in the past year, a security firm said Friday.

Twitter says hackers compromise 250K accounts

Feb 02, 2013

Twitter confirmed Friday that it had become the latest victim in a number of high-profile cyber-attacks against media companies, saying that hackers may have gained access to information on 250,000 of its ...

Recommended for you

UK: Former reporter sentenced for phone hacking

3 hours ago

(AP)—A former British tabloid reporter was given a 10-month suspended prison sentence Thursday for his role in the long-running phone hacking scandal that shook Rupert Murdoch's media empire.

Evaluating system security by analyzing spam volume

3 hours ago

The Center for Research on Electronic Commerce (CREC) at The University of Texas at Austin is working to protect consumer data by using a company's spam volume to evaluate its security vulnerability through the SpamRankings.net ...

Surveillance a part of everyday life

4 hours ago

Details of casual conversations and a comprehensive store of 'deleted' information were just some of what Victoria University of Wellington students found during a project to uncover what records companies ...

European Central Bank hit by data theft

5 hours ago

(AP)—The European Central Bank said Thursday that email addresses and other contact information have been stolen from a database that serves its public website, though it stressed that no internal systems or market-sensitive ...

Twitter admits to diversity problem in workforce

7 hours ago

(AP)—Twitter acknowledged Wednesday that it has been hiring too many white and Asian men to fill high-paying technology jobs, just like several other major companies in Silicon Valley.

Social Security spent $300M on 'IT boondoggle'

19 hours ago

(AP)—Six years ago the Social Security Administration embarked on an aggressive plan to replace outdated computer systems overwhelmed by a growing flood of disability claims.

User comments : 0