Cyber Spying, Digital Theft & Espionage

Cyber spying, digital theft and  espionage are about obtaining secret information without the permission and knowledge of the holder of the information. This data is taken from individuals, competitors, rivals, groups, governments and enemies for personal, economic, political or military advantage using proxy servers, cracking techniques and malware software.

A group of ecurity researchers callled Malware HunterTeam have recently encountered a new macOS malware sample believed to be the work of the North Korean group of hackers known as Lazarus. The threat has a very low detection rate and comes with capabilities that allow it to retrieve a payload from a remote location and run it in memory, making the forensic analysis more difficult.

Another recent study of cyber espionage activities shows that more than 200 unique families of malware have been used to eavesdrop on corporate and government employees, including attacks on the Japanese government.

These malware spies have formed  armies of nefarious hackers from around the world who use cyber warfare for economic, political, or military gain. 

These deliberately recruited and highly valued cybercriminals have the technical know-how to shut down anything from government infrastructures to financial systems or utility resources. They have influenced the outcome of political elections, created havoc at international events, and helped companies succeed or fail.

Many of these attackers use advance persistent threats (APTs) as their modus operandi to stealthily enter networks or systems and remain undetected for years and years.

These state-based threat actor teams are comprised of computer programmers, engineers, and scientists that form military and intelligence agency hacking clusters. They have tremendous financial backing and unlimited technological resources that help them evolve their techniques rapidly.

More than 200 unique families of malware have been used to eavesdrop on corporate and government employees, including attacks on the Japanese government, according to the results of a study of cyber-espionage activities released on July 25.
Unlike the massive botnets used by cyber-criminals to steal cash, such as the Gameover Zeus botnet, the espionage botnets typically consist of hundreds of compromised computers rather than tens or hundreds of thousands.

Most of the activity traces back to China, but some spying does not, including espionage carried out by a private security company that advertised "ethical" hacking courses, according to Dell Secureworks, which carried out the investigation. They identified  over 1,100 domain names used in the attacks and registered by online spies.

The Secureworks researchers identified many of the domains by finding suspicious domains and, when possible, registering them as they expired. He then listened for signs of botnet activity, an activity known as "sinkholing." 

Tapping this communication channel allowed Dell Secureworks to peer into the botnet's operation, including who had been infected. Stewart identified the malware into families based on the code and the network traffic each produced. Among the botnet activities caught in Stewart's sinkholing efforts were multiple attacks on Japanese targets, including government ministries, universities, municipal governments, trade organizations, think tanks, the manufacturing industry and the media.

Another sinkhole identified a relatively unknown piece of malware known as Elirks, which uses the Plurk microblogging service to communicate with its network of compromised computers. The attackers also used the service to post the current location of the command-and-control server, so that nodes ready to exfiltrate data can identify themselves and allow their controllers to log in. At least a dozen Plurk accounts were actively being used to communicate with infected systems, Stewart said in the report.

While not every company is in danger of becoming a target of cyber-spies, attackers tend to use the same techniques, much of it spread via carefully crafted email messages and targeted attacks.

Attacks aimed at stealing classified information from government agencies or trade secrets from corporations are also on the rise. Since Google outed Chinese hackers in a massive operation against some three-dozen U.S. and multinational companies, evidence has grown of widespread China-sanctioned espionage against governments, industry and human-rights groups.

China is not alone, however. Other countries-most notably the United States-have also used programs to infiltrate sensitive networks, steal information and interfere with other nations' activities. The US government has disclosed that it was responsible  for developing Stuxnet and used it as an attack method on Iran's nuclear weapond program.

eWeek:         CarbonBlack:           Bleeping Computer

You Might Also Read:

Spyware Website Taken Down:

Malware – The Hateful Eight:

 

« AI Market Forecast To Be Worth $190b By 2025
Cyber Security Talent Crunch - 3.5m Jobs Vacant »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

WEBINAR: 2024 and Beyond: Top Six Cloud Security Trends

WEBINAR: 2024 and Beyond: Top Six Cloud Security Trends

April 4, 2024 | 11:00 AM PT: Join this webinar to find out about six emerging trends dominating the cloud cybersecurity landscape.

Okta

Okta

Okta is an enterprise-grade identity management service, built from the ground up in the cloud to address the challenges of a cloud-mobile-interconnected world.

Massive Alliance

Massive Alliance

Massive is a global service agency providing internet monitoring, data & security threat surveillance and reputation management.

Accolade Technology

Accolade Technology

Accolade provides the most technologically advanced host cpu offload, 100% packet capture FPGA-based PCIe adapters and 1U platforms available in the network monitoring and cyber security markets.

Government Communications Security Bureau (GCSB)

Government Communications Security Bureau (GCSB)

GCSB contributes to New Zealand’s national security by providing information assurance and cyber security to the New Zealand Government and critical infrastructure organisations.

Tata Consultancy Services

Tata Consultancy Services

Tata Consultancy Services is a global leader in IT services, consulting & business solutions including cyber security.

FRSecure

FRSecure

FRSecure is a full-service information security management company that protects sensitive, confidential business information from unauthorized access, disclosure, distribution and destruction.

ProLion

ProLion

ProLion provides Data Integrity solutions that ensure organisations’ data remains secure, compliant, manageable and accessible.

Digital Element

Digital Element

Digital Element is a global IP geolocation and intelligence leader with unrivaled expertise in leveraging IP address insights to deliver new value to companies.

Appdetex

Appdetex

Appdetex is a global leader in securing your brand’s digital footprint. We are a full-service brand protection company in the online and mobile brand protection space.

Immunefi

Immunefi

Immunefi provides bug bounty hosting, consultation, and program management services to blockchain and smart contract projects.

Avint

Avint

Avint delivers transformational cybersecurity solutions that help both commercial and government entities achieve mission success.

Gen Digital

Gen Digital

At Gen™, our mission is to create technology solutions for people to take full advantage of the digital world, safely, privately, and confidently – so together, we can build a better tomorrow.

aFFirmFirst

aFFirmFirst

aFFirmFirst is a unique software solution offering a simple yet effective way for businesses to protect and control their online images and logo, as well as allowing one-click website verification.

ETI-NET

ETI-NET

ETI-NET is the worldwide leader in managing critical data for industries that never stop.

Cytex

Cytex

Cytex is the All-in-One solution for SMB data protection & compliance needs.

Keyrus

Keyrus

Keyrus is a global consultancy that develops data and digital solutions for performance management.