Symantech uncovers western Morpho cyber-espionage group
Symantech has outed a cyber-espionage group it calls "Morpho" that specifically targets large corporates. "The attackers appear&nbsp;to be motivated&nbsp;by financial gain,&nbsp;either by using&nbsp;the informationthemselves for their&nbsp;own benefit or selling&nbsp;it to a third party" says Symantech. &nbsp;The group has been active since 2013 and the report states that so far 49 corporates have been attacked in over 20 countries. &nbsp;Morpho is believed to be an independent group (not a single individual) which operates with a far higher skill-set that the typical cyber-gang. &nbsp;There are some indications that it may be based in the East Coast of the USA. &nbsp;Morpho is not to be confused with the FIN4 hacking group being investigated by the SEC, however note that Kaspersky call this new group "Wild Neutron".
Symantec has uncovered a new corporate espionage group, dubbed Morpho, that has compromised a string of major corporations in recent years.

Targets include high-profile technology, internet, commodities and pharmaceutical companies located or headquartered in the US, Europe and Canada.

Technology firms targeted by the Morpho espionage group for confidential information and intellectual property (IP) include Facebook, Twitter, Microsoft and Apple.

According to a Symantec report, Morpho is an independent group that operates at a much higher level than the average cyber crime gang.

Investigators said the group’s members are technically proficient, well-resourced and financially motivated.

Indications are that the group is selling information to the highest bidder or may be operating as hackers for hire. The report said stolen information could also be used for insider trading purposes.

It added that Morpho’s capabilities mirror some of the most advanced nation-state attackers and attacks have exploited at least one zero-day vulnerability, but Symantec believes it is run by fewer than 10 people.

Morpho developed a custom suite of malware, and little to no trace of its presence is left after an attack, allowing the group to keep a low profile.

But according to Symantec, the first signs of Morpho’s activities emerged in 2013, when several major technology and internet firms were compromised.

Twitter, Facebook, Apple and Microsoft disclosed that they had been compromised by very similar attacks that infected targets using a Java zero-day exploit through a compromised website popular with mobile developers.

The malware used in these attacks was a Mac OS X back door known as OSX.Pintsized. Subsequent analysis by security researcher Eric Romang identified a Windows back door, Backdoor.Jiripbot, which was also used in the attacks.

Following this flurry of publicity, the Morpho group slipped back into the shadows. However, an investigation by Symantec has revealed that the group has been active since at least March 2012 and its attacks have not only continued to the present day, but have also increased in number.

Symantec has to date discovered 49 different organisations in more than 20 countries that have been attacked by Morpho. Over time, a picture has emerged of a cyber crime gang systematically targeting large corporations to steal confidential data.

In addition to the four large technology companies that have acknowledged attacks, Symantec has identified five others compromised by Morpho, mainly headquartered in the US.

Investigators also found that Morpho has attacked three major European pharmaceutical firms. In the first attack, the attackers gained a foothold by first attacking a small European office belonging to one firm and using this infection to then move on to its US office and European headquarters.

This attack method appears to have been used in the two subsequent attacks on big pharma firms, with Morpho compromising computers in a number of regional offices before being discovered.

Morpho has also shown an interest in the commodities sector, attacking two major companies involved in gold and oil in late 2014. In addition to this, the central Asian offices of a global law firm were compromised in June 2015.

Morpho appears to have a good working knowledge of the organisations it is attacking and is focused on stealing specific kinds of information.

In many attacks, the group has succeeded in compromising Microsoft Exchange or Lotus Domino email servers to intercept company emails and possibly use them to send counterfeit emails.

The group has also attacked enterprise content management systems, which would often be home to legal and policy documents, financial records, product descriptions and training documents.

In some instances, the group has zoned in on specialist systems. For example, one attack saw it gain access to a physical security information management (PSIM) system, which is used for managing and monitoring physical security systems, including swipe card access. This could have provided the attackers with access to CCTV feeds, allowing them to track the movement of people around buildings.