Botnet that hid for 18 months
arstechnica.com
Botnet that hid for 18 months
1–10 of 25 posts
Re: Botnet that hid for 18 months
#2Isnt this significantly better than current botnets?
Is there any information about their targets?
Re: Botnet that hid for 18 months
#3Isnt this significantly better than current botnets? Is there any information about their targets?
It certainly seems like it to me.
Re: Botnet that hid for 18 months
#4Isnt this significantly better than current botnets? Is there any information about their targets?
This activity is steps above a normal botnet or threat actor such as standard ransomware operators. Not only living off the land, but taking care to blend in to the device/environment, not just dropping a randomly named blob. They show a narrow focus of targeting, awareness for evasion, and skill at maintaining persistence. This level of sophistication is not normal, for normal incidents.
Re: Botnet that hid for 18 months
#5Isnt this significantly better than current botnets? Is there any information about their targets?
This activity is steps above a normal botnet or threat actor such as standard ransomware operators. Not only living off the land, but taking care to blend in to the device/environment, not just dropping a randomly named blob. They show a narrow focus of targeting, awareness for evasion, and skill at maintaining persistence. This level of sophistication is not normal, for normal incidents.
I bet sometimes they kick out bots that are competing for resources. Or at least scan for the other bots and carve it out, otherwise when there's two that's when they both start mining full blast, they each try to cash in the crypto keys on the computer before the other one does, and the user gets around to reinstalling the OS because his computer is unusable.
Re: Botnet that hid for 18 months
#6Earlier quoted context omitted.
This activity is steps above a normal botnet or threat actor such as standard ransomware operators. Not only living off the land, but taking care to blend in to the device/environment, not just dropping a randomly named blob. They show a narrow focus of targeting, awareness for evasion, and skill at maintaining persistence. This level of sophistication is not normal, for normal incidents.
I bet sometimes they kick out bots that are competing for resources. Or at least scan for the other bots and carve it out, otherwise when there's two that's when they both start mining full blast, they each try to cash in the crypto keys on the computer before the other one does, and the user gets around to reinstalling the OS because his computer is unusable.
Based on the places where they were putting their threats I doubt mining was their goal. It sounds more that they were spelunking in case they wanted to ransomware and/or just wanting the information in a straightforward way. I wonder if also they were just using these servers as a foothold to attack something else. If you are mixing your traffic among an org's business presence it would be difficult to chase as a hop.
Re: Botnet that hid for 18 months
#7Interesting -- not targeting defense contractors or governments..
> In this blog post, we introduce UNC3524, a newly discovered suspected espionage threat actor that, to date, heavily targets the emails of employees that focus on corporate development, mergers and acquisitions, and large corporate transactions. On the surface, their targeting of individuals involved in corporate transactions suggests a financial motivation; however, their ability to remain undetected for an order of magnitude longer than the average dwell time of 21 days in 2021, as reported in M-Trends 2022, suggests an espionage mandate.
Is there enough money in high finance to support the development of sophisticated tools to rig trading markets?
Re: Botnet that hid for 18 months
#8This doesn’t sound like a botnet so much as a (possibly Russian) child of Stuxnet.
Re: Botnet that hid for 18 months
#9Interesting -- not targeting defense contractors or governments.. > In this blog post, we introduce UNC3524, a newly discovered suspected espionage threat actor that, to date, heavily targets the emails of employees that focus on corporate development, mergers and acquisitions, and large corporate transactions. On the surface, their targeting of individuals involved in corporate transactions suggests a financial moti…
> Is there enough money in high finance to support the development of sophisticated tools to rig trading markets?
Yes, but a well timed economic WMD on countries heavily reliant on efficient capital markets would greatly distract them from interfering in international events.
Re: Botnet that hid for 18 months
#10Earlier quoted context omitted.
I bet sometimes they kick out bots that are competing for resources. Or at least scan for the other bots and carve it out, otherwise when there's two that's when they both start mining full blast, they each try to cash in the crypto keys on the computer before the other one does, and the user gets around to reinstalling the OS because his computer is unusable.
Based on the places where they were putting their threats I doubt mining was their goal. It sounds more that they were spelunking in case they wanted to ransomware and/or just wanting the information in a straightforward way. I wonder if also they were just using these servers as a foothold to attack something else. If you are mixing your traffic among an org's business presence it would be difficult to chase as a ho…
Ya, this definitely wasn't about mining.
There isn't much info to go on, but it almost sounds like they were after the type of financial data that would be useful for insider trading.