Operation Dust Storm Hackers Set Sights On Japans Critical Infrastructure

Japanese energy, oil/gas, and transportation industries the target of stealthy, patient cyber-espionage group.

A threat group that has attacked a variety of targets including US defense agencies since 2010, has recently zeroed in all efforts on Japanese critical infrastructure. Though they have not yet been destructive or disruptive, the cyber espionage group has been quietly, persistently lurking within Japans power, oil/gas, construction, finance, and transportation industries,
according to researchers at the Cylance SPEAR Team
.
Dubbed Operation Dust Storm by researchers, the attackers tools of choice are mostly second-stage backdoors and their activities are related to current events. In 2011, early in the groups evolution, they targeted the US defense sector by using phishing lures related to the death of Libyan Prime Minister Muammar Gaddafi. More recently, in 2015, group compromised investment arm of a Japanese automaker, implanting a second-stage backdoor (via an existing backdoor) two weeks before 11 Japanese autoworker unions demanded a monthly raise of 6,000 yen.
Their goals thusfar appear to be reconaissance and long-term espionage. At this time, SPEAR does not believe the attacks were meant to be destructive or disruptive, according to the report. However, our team believes that attacks of this nature on companies involved in Japanese critical infrastructure and resources are ongoing and are likely to continue to escalate in the future.
The group has managed to maintain persistence and stay under the radar, by registering new domain names, taking advantage of dynamic DNS, and using a variety of customized backdoors -- particularly second-stage backdoors with hard-coded proxy addresses and credentials, as well as Android backdoors. Their mobile malware initially only forwarded SMS and call data to command-and-control servers, then added the ability to enumerate and exfiltrate specific files from devices. Those efforts to stay ahead of security tools have been largely successful.
According to the report: No antivirus vendors seem to reliably detect most of the variants SPEAR identified.

Last News
▸ Some DLP Products Vulnerable to Security Holes ◂ Discovered: 23/12/2024 Category: security	▸ Scan suggests Heartbleed patches may not have been successful. ◂ Discovered: 23/12/2024 Category: security	▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Operation Dust Storm Hackers Set Sights On Japans Critical Infrastructure