New attacks targeting ministries, media and others: Trend Micro
By Digital News Asia May 28, 2013
- New targeted attack campaign compromised public and private sector entities across 100 countries
- Involved nearly 12,000 unique IP addresses connected to two sets of command-and-control (C&C) servers
DIGITAL information security firm Trend Micro Incorporated has reported a new targeted attack campaign called 'Safe' which has compromised government ministries, technology firms, media outlets, academic institutions and non-governmental organisations from over 100 countries.
Macky Cruz, security focus lead of the company's TrendLabs, said that these obvious threat campaigns are becoming increasingly well known within the security community.
“However, there are some new and smaller campaigns emerging as well, which could create successful and long-term compromises of high-value organisations and enterprises worldwide, and these campaigns cannot be ignored," she said.
These campaigns, such as 'Safe', use small clusters of C&C servers, new malware as well as attack fewer targets. The 'Safe' campaign involved nearly 12,000 unique IP addresses that were connected to two sets of command-and-control (C&C) servers with the countries involved being widely dispersed.
It targeted its victims using spear-phishing emails containing a malicious attachment exploiting a Microsoft Office vulnerability (CVE-2012-0158) and leveraging social engineering techniques for initial intrusion, TrendLabs said in a statement.
In addition, the research discovered in its finding that the average number of actual victims connected to the C&C server remained at 71 per day, with few, if any, day-to-day changes. The research also noted that the Safe campaign began targeting specific industries and communities in specific regions as early as October 2012.
While determining the intent and identity of the attackers remains difficult, Trend Micro assessed that the Safe campaign is targeted and uses malware developed by a professional software engineer who may be connected to the cybercriminal underground in China.
However, the relationship between the malware developers and the campaign operators themselves remains unclear.
Trend Micro recommends a comprehensive security risk management strategy that goes further than advanced protection to meet the real-time threat management requirements of dealing with targeted attacks.
The company has also released a research paper that documents the operations of this 'Safe' campaign along with their threat protection recommendations. To download a PDF of the research paper, click here.