[ISN] 'Time Bomb' Attack Out Of China Defused

http://www.darkreading.com/threat-intelligence/167901121/security/attacks-breaches/240150216/time-bomb-attack-out-of-china-defused.html

By Kelly Jackson Higgins
Dark Reading
Mar 06, 2013

Mandiant's in-depth report published last month on a prolific cyberespionage 
team tied to the Chinese military was, in turn, used as a lure in other 
targeted attacks -- by what appears to be different Chinese hacker groups.

The attacks, spotted by Seculert, used a phony version of the report as a lure 
in a spearphishing attack against Japanese and Chinese journalists. The 
targeted attack against the Japanese victims came with an interesting twist: a 
"time bomb" element, according to Aviv Raff, CTO at Seculert.

Mandiant's report calls out the People's Liberation Army Unit 61398 as the APT1 
group responsible for cyberspying against multiple industries.

The malware used in the attacks on Japanese journalists was programmed to 
trigger during 8 a.m. and 7 p.m. only, according to Raff. Raff says aside from 
the malware communicating with legitimate Japanese websites, it also came with 
another command-and-control domain in memory, one that was registered to a free 
dynamic DNS server and went to a Korea-based IP address.

During the programmed time frame, the malware would communicate with "the real 
C2 server," he says, rather than the legit Japanese websites. It also would 
then download additional malware.

[...]


______________________________________________
Visit the InfoSec News Security Bookstore
Best Selling Security Books and More!
http://www.shopinfosecnews.org