Feeds

Spies launch hack attacks on Mongolia... to see who its friends are – report

Like checking up on your kid's Faceboo... well, not really

SANS - Survey on application security programs

Cyber-spies are targeting Mongolian businesses and government agencies to keep the attackers "aware" of the land-locked country's relationships with "Western influences" like the US and the European Union, according to a recent report.

Cyber Squared’s ThreatConnect Intelligence Research Team (TCIRT) blames a "state-sponsored" Chinese hacking group for the campaign, which it says shows evidence of offensive tactics against Mongolian targets which are very similar to those long applied against Tibetan and ‪Uyghur ‬nationalists and affiliated groups.

The custom malware used in the anti-Mongolian campaigns shares the same functionality of malware used by an unidentified Chinese cyber-warfare unit that has been dubbed “Comment Crew” or “APT1”, Cyber Squared reports.

"TCIRT has identified a series of targeted cyber attacks that have been directed against Mongolian and allied networks by several Chinese Computer Network Exploitation (CNE) groups," the cyber intelligence agency explains.

It adds:

Retrospective analysis of several targeting campaigns identified numerous examples of focused Chinese [exploitation] directed against economic, military, and diplomatic targets within Mongolia and Mongolian partners. Persistent remote access to strategic Mongolian networks would help China maintain awareness of changes in Mongolian relations with the US and other Western influences in an effort to better protect China’s national interests in Mongolia and the region.

Booby-trapped documents associated with the attack include an announcement for a joint US-Mongolia military exercise called Khaan Quest 2014. Retrospective research by Cyber Squared identified additional decoy documents, written in Mongolian, themed around events such as the June 2013 Mongolian presidential election.

Cyber Squared reckons that attempts to hack Mongolian government and business computers are been motivated by "Mongolia’s attempt to steer a more independent path by reaching out to what it calls 'third neighbours' such as the United States, Japan, South Korea, and the European Union."

The malware-fuelled hacking campaign would "help China maintain awareness of changes in Mongolian relations with the US and other Western influences and protect their national interests in Mongolia", thus helping to give the Chinese government the edge in relations with its northern neighbour.

More details on the attacks - including screenshots and code snippets - can be found in a blog post by Cyber Squared here. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.