Threat Group 3390 or Emissary Panda: elite Chinese APT brigade
Dell Secure Works has published an analysis into one of China's most effective hacking groups - Emissary Panda. Whilst the group is known to have hacked various 'political' targets, its main focus is corporate IP theft: indeed what sets the group apart from rivals is the level of sophistication in their data targeting. &nbsp;Its entry methodology is less sophisticated than others, relying on "old vulnerabilities in software such as Java, Flash or Adobe Reader to get into a website". &nbsp;Once in the group tends to wait a few weeks to ensure that it has not been detected before locating and taking highly targeted data. The group's primary focus is corporations in the US and the UK where specifically it creates "watering holes" to lure in unsuspecting employees of the target companies.
"We have no doubt they will have targeted organisations in Australia," he said. "One of the interesting things about this group is the sheer diversity in the strategic web compromises to reach their victims."

The report revealed that websites based in a variety of countries including Iran, Iraq, Zambia, Italy, Qatar and Ecuador had been subject to so-called "watering hole" attacks, in which websites used by the intended victim are infected with viruses known as malware.

As well as the Russian Embassy, embassies representing countries in Africa, Europe, Asia and the Middle East have also been compromised, along with other government bodies, energy companies and non-government organisations.

Strategic data theft

After monitoring the group for two years, Dell SecureWorks has identified the methods that Threat Group 3390 employs to penetrate a business.

The group first places a code on the website redirecting visitors to a malicious site. If the visitor has an IP address of interest, the computer user is served an exploit kit, which targets vulnerabilities in their systems the next time they return to the compromised website.

Advertisement

Dr White said the group generally relied on old vulnerabilities in software such as Java, Flash or Adobe Reader to get into a website.

"The group only do what they have to to get in," he said. "They're getting in on vulnerabilities which are four or five years old and that's a result of companies not securing their networks."

Once inside the network the group attacks the domain controller (the network server which operates as an identification directory) and steals the security credentials for a variety of users.

From this point the hackers can move laterally to other websites in as little as two hours, but they normally wait for about four weeks before they start stealing data from an organisation's network.

"Companies have more time than they think [to kick out the attackers]," Dr White said. "Usually if they're a client of ours we have network-based signatures which detect the group's tools and we notify the organisation before the attackers get anywhere.

"But most commonly the data gets taken and then weeks or months later they get a note from an agency like the FBI saying they've had X number of gigabytes of data taken."

Advertisement

As well as going after the domain controller, the group installs a keylogger (a type of surveillance software that records which keys are hit when people are typing), and a so-called "backdoor" on Microsoft Exchange servers. This backdoor ensures the attackers have a way to get back into the system even if they are spotted and booted out.

To set up this backdoor the group use a tool called PlugX, a remote access tool giving the attackers full access through a remote location, as well as other tools such as HttpBrowser, China Chopper and a vulnerability identifying tool known as Hunter.

Dr White said the Chinese group was unique because it acted in a strategic way in determining which data it steals. "It's hard to quantify in terms of dollar signs how much damage this could do to a company," he said.

"Typically groups go in and take everything, but what we see with this group is they take a listing of everything, but then they come back and steal the data related to only two or three projects, so it appears there are specific tasks involved."

The group has largely avoided detection so far by only using a few compromised websites at any one time.

Well-funded operation

Advertisement

Dr White could not determine how the group was funded, but said the large-scale attacks showed it was well resourced and funded.

"We want companies to be able to take this information and use the technical indicators we've provided to look for evidence of compromise, but also be able to detect these adversaries moving forward," he said.

"The group will start building new infrastructure and using new tools, but it takes significantly more effort to change the way they compromise victims and how they move around the network when they're inside."

The report recommended businesses mandate a two-factor authentication process for all remote access solutions, remove local administrator rights, audit ISAPI filters on Microsoft Exchange servers and keep third-party software up to date.

Dr White said many companies mistakenly believed they had nothing of value to steal, so they did not bother keeping their security up to date.

"But if you have any IP [address] that gives you a competitive advantage, then there will be a group, maybe even this one, trying to steal it," he said. "Sometimes businesses simply don't have the funding to adequately secure their network."

Advertisement

Dr White said Threat Group 3390 was just one out of potentially hundreds of similar black-hat groups around the world. "A lot of compromises aren't reported publicly," he said.

On Wednesday details emerged of a suspected Russian hacker who had hacked into the accounts of a number of retail clients of Commonwealth Securities Ltd, ETrade Australia and Australian Investment Exchange Ltd, targeting 13 penny stocks listed on the Australian Securities Exchange.

After infiltrating these accounts he traded the penny stocks in such a way that an artificially inflated price was created. The Russian hacker then collected the profits.

The Supreme Court of NSW ruled that more than $77,000 be restrained, after an investigation by the Australian Securities and Investments Commission and the Australian Federal Police uncovered the suspicious trades in 2014.