Digital stakeout of Chinese hacker gang reveals 100+ victims

[Matt]

Crew behind 'Comfoo' RAT may have rooted through videoconferencing vendor for ways to watch confidential meetings in government, businesses

A Chinese hacker gang whose malware targeted RSA in 2011 infiltrated more than 100 companies and organizations, and was so eager to steal data that it probed a major teleconference developer to find new ways to spy on corporations, according to researchers.

The remote-access Trojan, or RAT, tagged as "Comfoo" is largely inactive, said a pair of veteran researchers from Dell SecureWorks, who presented their findings at last week's Black Hat security conference.

But their discoveries showed just how pervasively a dedicated group of attackers can infiltrate networks and walk away with secrets.

"We're not seeing it used to the extent it was before," said Joe Stewart, director of malware research at SecureWorks, in explaining why he and his college, Don Jackson, revealed their undercover campaign.

For more than 18 months, Stewart and Jackson, a senior security researcher with SecureWorks' Counter Threat Unit (CTU), secretly monitored some of the workings of Comfoo, which they believe was the work of a hacker crew they've named the Beijing Group. The gang is one of China's top-two hacker organizations.

To start, Stewart captured a sample of the malware used in the RSA attack, at the time attributed to Chinese hackers, then reverse-engineered the encryption that the malware used to mask instructions to and from the gang's command-and-control (C&C) servers.

Eventually, Stewart was able to spy on the hackers as they logged onto those C&C servers. As they did, Stewart snatched the victims' MAC addresses -- unique identifiers for network hardware -- their IP, or "Internet protocol" addresses, and finally, a tag the hackers used to label each data-stealing campaign.

SecureWorks was not able to see what data the attackers were stealing, but their passive monitoring reaped dividends.

"We've done similar ops like this before," said Stewart, "but with the custom stuff, you rarely get this kind of insight or this level of detail of the attacks and victims."

SecureWorks said its stealthy stakeout -- which was intermittent to ensure that the hackers weren't aware they were watching -- uncovered over 100 victims, more than 64 different campaigns and 200-plus Comfoo variants. The Atlanta-based security firm notified some of the victims directly, and others through CERTs, the computer emergency response teams that governments maintain.

"This was just a snapshot of the [total] victims," cautioned Stewart.

The hackers targeted a wide range of government agencies and ministries, private companies and trade organizations in fields as diverse as energy, media, semiconductors and telecommunications. They seemed eager to grab information from almost anywhere and anyone, although the victims were concentrated in Japan, India, South Korea and the U.S.

Sursa