Dell SecureWorks researchers have discovered a cyber espionage campaign targeting several large companies, including two in the energy sector, according to an article in Computer Weekly.
The campaign, dubbed Mirage, targeted an oil company in the Philippines, an energy firm in Canada, a military organization in Taiwan and other unidentified targets in Brazil, Israel, Egypt and Nigeria, the article says.
This is the second cyber espionage campaign to be uncovered this year by the Counter Threat Unit (CTU) of security firm Dell SecureWorks. The first campaign, dubbed Sin Digoo, targeted petroleum companies in Vietnam, government ministries in different countries, an embassy, a nuclear safety agency and other business related groups, Computer Weekly reports.
The Dell SecureWorks researchers believe that either the same group is behind both campaigns, or whoever is responsible for Mirage is working closely with those behind Sin Digoo, the article says. Three command and control domain names in the Mirage campaign are owned by someone using the same email addresses as the owner of several C&C domains that were used in the Sin Digoo campaign.
The command and control IP addresses belong to the China Beijing Province Network (AS4808), said researchers. The China Beijing Province Network is known for connections to malware and espionage, the article says. The security researchers said the Mirage malware avoids detection by disguising its command and control communications as Google searches by using SSL communications and a similar URL pattern to that of a Google Search.
According to testing site Virus Total, only half of the major anti-virus scanners detected Mirage, the article reports.
The victims of the Mirage campaign are being infected by “spearphishing” emails containing a malicious executable. Clicking on the attachment drops a pdf, along with the executable, Computer Weekly reports.
One of the spearphishing emails used in this campaign contained a pdf of a news story titled “Yemeni Women can participate in politics just like men, says President Saleh.”
Energy companies, along with pharmaceutical and high-tech industries, are the most common targets of these advanced persistent threat campaigns, says Don Smith, technology director at Dell SecureWorks, in the article.
“But we are seeing other industries now being targeted, and all businesses should ask themselves just how confident they are that their cyber security regime minimizes the risks of attack, but I would say very few in my experience,” he tells the Gartner Security & Risk Management Summit 2012 in London, as reported in the article.
Researchers at Dell SecureWorks have identified more than 580 separate families of malware what are related to targeted advanced persistent attacks, the article says. In the face of this new breed of attacks, Smith says organizations should ensure they had a layered approach to security.
“There is no silver bullet to deal with these attacks which is why businesses need to have protections at all levels,” he says in the article. Organizations need to understand the threat landscape, who is likely to attack them and why, says Smith, so they can prepare accordingly.
Where possible, he says in the article, this should include a forensic capability so that in the event of an attack, an organization can identify exactly what went wrong.
“Information security professionals must talk to the business executives to find out what they are most worried about losing and create an informed security strategy based on that,” says Smith.
