Feeds

Almost 2,500 firms breached in ongoing hack attack

Zeus and Waledac unite in global botnet

Security for virtualized datacentres

Criminal hackers have penetrated the networks of almost 2,500 companies and government agencies in a coordinated campaign that began 18 months ago and continues to steal email passwords, login credentials, and other sensitive data to this day, a computer security company said.

The infections by a variant of the Zeus botnet began in late 2008 and have turned more than 74,000 PCs into remote spying platforms that have siphoned highly proprietary information out of at least 10 federal agencies and thousands of companies, according to research from NetWitness, a Herndon, Virginia-based network forensics firm. Many of the victims are Fortune 500 firms in the financial, energy, and high technology industries.

Company researchers have already reported the attacks to federal authorities and are in the process of notifying individual victims.

"The botnet is still active and still actively being managed by the organized criminal activity behind it," NetWitness CTO Tim Belcher told The Register. "Over the last month, we've seen it retask its (victim) members half a dozen times looking for different types of information."

The revelation comes a month after Google disclosed that its network and those of at least 20 other large companies were penetrated by hackers targeting intellectual property. By contrast, the attack discovered by NetWitness has breached about 2,400 companies, according to a 75-gigabyte cache of data stolen over a four-week period that the company was able to intercept. Because it's a small fraction of the information siphoned during the 18-month attack, the actual number of affected organizations could be much higher.

The finding sheds new light on Zeus, which by most accounts is ranked as the world's No. 2 botnet in terms of infected computers. While the malware was generally believed to focus on the theft of online-banking credentials, NetWitness researchers have observed the trojan stealing passwords used to access corporate networks, source code repositories, and even dossier-level data sets of individuals who used victim machines.

The researchers were also surprised to find the infected machines working hand-in-hand with malware that's generally considered to rival Zeus. More than half of the compromised PCs were also infected by Waledac, a bot primarily used to send spam that contains a backdoor that's driven by a highly efficient peer-to-peer engine.

While it's not uncommon for PCs to be infected by multiple bots, the researchers speculate that the unusually high amount of overlap means the criminals behind the attacks used multiple strains in the event that one infection were to be discovered by security personnel.

The mass infections were discovered on January 26, when a NetWitness employee was performing a scan on a customer's network that had been suspected of being breached. He soon found that a PC on the system was infected by a botnet known as Grum. Curiously, when the compromised machine contacted a command and control channel at silence7.cn, it was instructed to download and execute a file related to Zeus.

"Its pretty evident to us that it's a resilience play where they're infecting it with multiple pieces of malware," Belcher said.

By cross-referencing the contact details for silence7.cn, the researchers were able to find evidence that the attacks were probably carried out by the same individuals in Eastern Europe suspected of orchestrating a phishing scheme that spoofed National Security Agency emails in an attempt to steal passwords from US government and military organizations.

The crew used command-and-control servers physically located in Germany and the Netherlands, and most of the domain names were obtained from China-based registrars, most likely because they are slow to respond to reports of abuse, Belcher said.

Belcher declined to name any of victims breached in the attacks. But according to a report in The Wall Street Journal, the companies included pharmaceutical giant Merck and healthcare provider Cardinal Health. Both companies admitted to being affected but said they had "isolated and contained the problem," the paper said.

Citing unnamed people, The Wall Street Journal report said that Paramount Pictures and Juniper Networks were also infiltrated. It went on to report that the attackers obtained the user name and password of a US soldier's military email account, but a Pentagon spokesman declined to confirm. In all, NetWitness found evidence that organizations in 196 countries were breached, with concentrations highest in Egypt, Mexico, Saudi Arabia, Turkey, and the United States.

NetWitness has dubbed it the "kneber botnet" based on part of the Yahoo email address used as a contact for many of the domain names tied to the attacks.

The findings are the latest to cast doubt on the ability of Fortune 500 companies and government agencies to secure their networks against a rising cast of well-funded hackers sponsored by nation states or organized-crime gangs.

"Many of these organizations I am aware of their expertise in security, and yet this continues to operate on their internal networks with impunity," Belcher said. "It tells me our approach to net security is failing on a broad scale." ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.