Digital Bond Spear-Phishing May Link to Larger Attack Campaign

Similarities uncovered between the attack on Digital Bond and attacks targeting other organizations

An unsuccessful spear-phishing attempt targeting security company Digital Bond may be linked to a larger campaign, security researchers say.
Digital Bond specializes in assessing the security of industrial-control systems. Last week, it revealed that an employee had received an email from an account meant to impersonate CEO Dale Peterson. The message linked to a .zip file based on an old research paper the company had published.
When the .zip file
was analyzed
by the Shadowserver Foundation, researchers concluded the attack patterns were very similar to the actors behind the Shady Rat campaign revealed by McAfee in 2011. McAfee researchers traced the Shady Rat attack back to 2006 and said that it affected scores of organizations, ranging from defense contractors to the United Nations.
According to Shadowservers Ned Moran, the similarities between Shady Rat and the attack on Digital Bond include the use of encoded commands hidden in otherwise normal looking Web pages, as well as an overlap in the command-and-control (C&C) infrastructure used in this attack with previous Shady RAT attacks.
The malware at the center of the attack was hosted on research.digitalvortex.com. Once on a system, it was designed to create a backdoor and connect to a C&C server at hint.happyforever.com.
Its a bit concerning that a company whose sole focus is securing industrial control systems should be spear phished, blogged Digital Bonds Reid Wightman. The attacker clearly went to enough trouble to try to understand ICS security lingo to get the employee to open the link, and had to compromise a DNS server ... Thankfully the attack was unsuccessful -- paranoia pays off. It is definitely a lesson in ‘be careful what you open’ ... even if looks to be coming from Digital Bond (or your boss, as in this case), don’t open a file if you aren’t expecting it.
Further analysis by researchers at AlienVault and IOActive
revealed more details
.
Using the information extracted from the binaries and the servers involved on the attack, we were able to identified more files and campaigns launched by this group during the last months, explained Jaime Biasco, labs manager at AlienVault, in a blog post.
Among the targets in those attacks were the Japan Network Information Center and the Hong Kong University of Science and Technology.
We have identified that the group behind these attacks is using hacked web servers to host the malicious configuration files, Biasco added. Based on the networks hosting the C&C IPs (mainly universities), it is very likely that these servers are also hacked and some kind of proxy is installed on them to redirect the traffic to the real C&C server. This can be easily achieve(d) using HTran or other similar software commonly used by Chinese hacker groups in this kind of campaigns.
Spear phishing is becoming a favorite vector for launching targeted attacks, which means users need to get trained faster, said Rohyt Belani, CEO of PhishMe, a service that enables companies to train and test employees phishing knowledge using simulated attacks.
We have found that immersing people in the [education] experience through mock phishing exercises, and presenting immediate, bite-sized education to those who are susceptible has had the desired effect of reducing human vulnerability to these attacks. The PhishMe service can emulate zip-wrapped PDF files that are similar to those used in the attacks on defense contractors, he said.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security	▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security	▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Digital Bond Spear-Phishing May Link to Larger Attack Campaign