In 2010 McAfee Labradors processed an average of just about 55,000 pieces of latest malware every day. In which nearly mind-numbing quantity makes it difficult for almost any particular attack to stand out. Today, however, I want to highlight one large size attack that is a clear example of how cybercrime has evolved from something of a weekend enthusiast affair to a very professional activity. We refer to this as specific attack “Night Dragon.”
Starting in November last year, covert cyberattacks were released against several global oil, energy, and petrochemical companies. The attackers targeted amazing operations and project-financing information on gas and oil field bids and operations. This information is highly sensitive and can help to make or break multibillion money deals in this really competitive industry.
McAfee offers identified the tools, strategies, and network activities utilized in these attacks, which carry on to this day. These types of attacks have involved a more elaborate mix of hacking strategies including social engineering, spear-phishing, Windows exploits, Active Directory compromises, and the use of remote management tools (RATs).
While the list above may seem amazing to the layperson, these methods and tools are comparatively unsophisticated. The tools basically appear to be common host administration techniques that utilize administrative credentials. This is largely why they have the ability to evade detection by regular security software and system policies. In fact these types of techniques are very typical across many of the particular intrusions we examine. Attack techniques that we published about since 1999 within the original Hacking Exposed textual content still work very well a decade later.
Because the initial compromises, however, McAfee and other security vendors have been in a position to identify the malicious computer software and tools used during these attacks and provide protection. McAfee recommends that companies review McAfee ePolicy Orchestrator software and anti-virus logs with regard to ‘NightDragon’ signature detections and also Network Security Platform invasion detection systems for ‘BACKDOOR: NightDragon Communication Detected’ alerts.
Only through recent analysis and the discovery of common artifacts and evidence correlation have all of us been able to figure out that a dedicated energy has been ongoing for around two years and, most likely, as many as 4. We can now relate the various signatures that we have seen in these attacks to this specific event called Night Monster.
We have also used a close look at who might be at the rear of these attacks. We possess strong evidence suggesting how the attackers were based inside China. The tools, methods, and network activities used in these attacks originate largely in China. These equipment are widely available on the Chinese Web forums and also tend to be utilized extensively by Chinese nuller groups.McAfee has decided identifying features to support companies with detection and investigation.
The Night Dragon attacks as well because countermeasures and tips regarding how to identify if your organization was targeted in these attacks are detailed in a white paper published nowadays.
Well-coordinated, targeted attacks such as Night Dragon, orchestrated by a increasing group of malicious enemies committed to their targets, are rapidly on an upswing. These targets have now moved beyond the security industrial base, government, and also military computers to consist of global corporate and business targets.
More and more, these attacks focus this is not on using and abusing machines within the organizations being compromised, but rather around the theft of specific information and intellectual property. Focused and efficient define the very essence of today’utes attackers. Thus, it is essential that organizations work proactively toward protecting ab muscles lifeblood of many businesses: their intellectual property.
Read More:
Global Energy Industry Hit In “Night Dragon” Attacks
