Hundreds of APTs linked to Chinese Army department

Posted by   Virus Bulletin on   Feb 20, 2013

'Unit 61398' employs hundreds of people.

A new report by security firm Mandiant links a large number of cyber-espionage cases to a department of the Chinese army.

The report is far from the first to point to China as the source of many targeted attacks. However, it would be too easy to dismiss the report as a mere PR exercise (even in the week preceding RSA) for Mandiant, which provides consultancy services to many victims of such attacks. For that, the report is far too detailed - and for anyone who wants to gain an insight into the working of advanced persistent threats, it is worth reading.

According to Mandiant, the group 'APT1', whose activities were first noticed in 2006, has been stealing data from at least 141 organisations, 115 of which are based in the United States. The attackers maintained access to the average victim for about a year, being able to transfer large amounts of data without being noticed.

For most organisations, the compromise starts with a spear-phishing email with a malicious attachment which is used to establish a foothold inside the targeted network. Once inside, the attackers try to escalate the privileges they have, which they use to 'move around' the internal network and obtain access to the machines that contain the information they're after. They also tend to install new backdoors, or other methods for accessing the network, so that they maintain access even after their initial break-in is discovered.

Not all targeted attacks that are thought to originate in China are believed to have been performed by APT1. The report explicitly states that attacks like 'Aurora', 'Nitro' and 'Elderwood' are attributed to other APT groups.

Mandiant's researchers deserve credit for the vast amount of work they have put into this report. However, it would be wrong simply to conclude that China is the problem when it comes to malware or cyber-espionage.

Firstly, although these aren't mentioned in the report, the likes of Stuxnet and Flame show that Western governments aren't exactly innocent when it comes to using malware to attack or spy on foreign organisations. (For all we know, a thorough investigation into Chinese organisations may reveal a large number of cyber-espionage cases that can be linked to the US government.)

More importantly, if it is your job to protect very valuable information, paranoia is a must. The least you can do is to assume that the Chinese, American, Russian and (insert nation) governments are all after your data. The fact that it now turns out that, in some cases, the Chinese government is behind these attacks, shouldn't make any difference.

The report can be found at Mandiant's website here.

Posted on 20 February 2013 by Martijn Grooten



Latest posts:

Paper: How It Works: Steganography Hides Malware in Image Files

A new paper by CYREN researcher Lordian Mosuela takes a close look at Gatak, or Stegoloader, a piece of malware that was discovered last year and that is controlled via malicious coded embedded in a PNG image, a technique known as steganography.

Paying a malware ransom is bad, but telling people to never do it is unhelpful advice

The current ransomware plague is one of the worst threats the Internet has seen and it is unlikely to go away any time soon. But telling people to never pay the ransom is unhelpful advice.

VB2015 paper: VolatilityBot: Malicious Code Extraction Made by and for Security Researchers

In his VB2015 paper, Martin Korman presented his 'VolatilyBot' tool, which extracts malicious code from packed binaries, leveraging the functionality of the Volatility Framework.

VB2016 programme announced, registration opened

We have announced 37 papers (and four reserve papers) that will be presented at VB2016 in Denver, Colorado, USA in October. Registration for the conference has opened; make sure you register before 1 July to benefit from a 10% early bird discount.

New tool helps ransomware victims indentify the malware family

The people behind the MalwareHunterTeam have released a tool that helps victims of ransomware identify which of more than 50 families has infected their system, something which could help them find a tool to decrypt their files.