Feeds

Spies launch hack attacks on Mongolia... to see who its friends are – report

Like checking up on your kid's Faceboo... well, not really

Next gen security for virtualised datacentres

Cyber-spies are targeting Mongolian businesses and government agencies to keep the attackers "aware" of the land-locked country's relationships with "Western influences" like the US and the European Union, according to a recent report.

Cyber Squared’s ThreatConnect Intelligence Research Team (TCIRT) blames a "state-sponsored" Chinese hacking group for the campaign, which it says shows evidence of offensive tactics against Mongolian targets which are very similar to those long applied against Tibetan and ‪Uyghur ‬nationalists and affiliated groups.

The custom malware used in the anti-Mongolian campaigns shares the same functionality of malware used by an unidentified Chinese cyber-warfare unit that has been dubbed “Comment Crew” or “APT1”, Cyber Squared reports.

"TCIRT has identified a series of targeted cyber attacks that have been directed against Mongolian and allied networks by several Chinese Computer Network Exploitation (CNE) groups," the cyber intelligence agency explains.

It adds:

Retrospective analysis of several targeting campaigns identified numerous examples of focused Chinese [exploitation] directed against economic, military, and diplomatic targets within Mongolia and Mongolian partners. Persistent remote access to strategic Mongolian networks would help China maintain awareness of changes in Mongolian relations with the US and other Western influences in an effort to better protect China’s national interests in Mongolia and the region.

Booby-trapped documents associated with the attack include an announcement for a joint US-Mongolia military exercise called Khaan Quest 2014. Retrospective research by Cyber Squared identified additional decoy documents, written in Mongolian, themed around events such as the June 2013 Mongolian presidential election.

Cyber Squared reckons that attempts to hack Mongolian government and business computers are been motivated by "Mongolia’s attempt to steer a more independent path by reaching out to what it calls 'third neighbours' such as the United States, Japan, South Korea, and the European Union."

The malware-fuelled hacking campaign would "help China maintain awareness of changes in Mongolian relations with the US and other Western influences and protect their national interests in Mongolia", thus helping to give the Chinese government the edge in relations with its northern neighbour.

More details on the attacks - including screenshots and code snippets - can be found in a blog post by Cyber Squared here. ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.