APT Attackers Hit Japans Biggest Defense Contractor

Targeted attack against Mitsubishi Heavy Industries demonstrates how APTs arent just going after U.S. companies

Mitsubishi Heavy Industries became the latest high-profile target of cyberespionage -- driving home the reality that the advanced persistent threat (APT) isnt just a U.S. problem.
This isnt the first time a Japanese defense contractor has been hit by APT attackers -- its just the first time such an attack has gone public, security experts say. News of the attack was first reported in the
Japanese press
and was then picked up by Reuters today.
According to a translated statement by Mitsubishi Heavy Industries, which builds submarines, missiles, and nuclear power components, the company first detected the intrusion in mid-August.
Weve found out that some system information such as IP addresses have been leaked and thats creepy enough, a spokesman for Mitsubishi Heavy is quoted as saying in a
Reuters report
. We cant rule out small possibilities of further information leakage but so far crucial data about our products or technologies have been kept safe.
Some 80 machines were infected with malware at the firms Tokyo headquarters and manufacturing and research and development facilities: Kobe Shipyard & Machinery Works, Nagasaki Shipyard & Machinery Works and Nagoya Guidance & Propulsion System Works were among the sites reported to have been infiltrated by attackers. Around eight different types of malware were detected on the various machines, the reports said.
Richard Bejtlich, chief security officer and vice president at Mandiant, says the Japanese have been working on an initiative to defend against APT-type attacks. Theres no doubt that Japan is worried about Chinese espionage … I understand that theres an initiative starting next year to help their industry resist those attacks, Bejtlich says.
While the attack on a high-profile industrial power in Japan isnt really a surprise, it confirms theories that these types of attacks are a global problem. Its validation that this isnt simply a U.S. problem, Bejtlich says. Hopefully, people [worldwide] will realize this isnt a manufactured threat, but its a real problem and fairly widespread.
Mitsubishi Heavy Industries, meanwhile, said in a statement that network addresses might have been leaked and that its still investigating the attack and the extent of the data exposure.
I dont suppose we need another wake-up call, but this news leaves a disconcerting after-taste, says Will Irace, director of research for Fidelis. There are some good technologies available to help advanced persistent defenders safeguard their enterprises. But it still feels like were fighting blind because targeted companies are reluctant to come forward with details on how they were victimized.
Irace says hed like victims to cooperate more closely to share information. The deck is stacked against them: Strategy is going to be at least as important as technology if theyre going to catch up, Irace says.
Mandiants Bejtlich says while the Mitsubishi attack isnt likely to help spur more cooperation among victim organizations around the world, it could encourage some diplomatic cooperation. At the diplomatic level, it makes a difference, he says. It continues to point to the Chinese as doing something that is not considered to be responsible.
Theres really no technical way to resolve the cyberespionage problem, he says, but it could be addressed at the national and diplomatic levels.
Meanwhile, details were scarce about how the attackers got in and how far they got. Adam Powers, chief technology officer for Lancope, says it appears Mitsubishi Heavy Industries relied too heavily on its perimeter security. Many organizations place the bulk of their cyberdefense technology at the perimeter of the network. Unfortunately, once the attackers breach the perimeter defenses, its easy to compromise additional unprotected resources behind the outer wall. Once the attackers have a persistent foothold within the network, detection and remediation can become very difficult, Powers says. Given the scope of the attack on Mitsubishi Heavy Industries, it may be months before all of the breached resources are discovered.
Mitsubishi Heavy Industries had $3.4 billion in contracts with Japans Ministry of Defence for the year as of March – one-fourth of the agencys spending for the year, according to Reuters. The company makes surface-to-air Patriot missiles and AIM-7 Sparrow air-to-air missiles, and manufactures wings for Boeings 787 Dreamliner jet.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security	▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security	▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
APT Attackers Hit Japans Biggest Defense Contractor