South America the Target of Sowbug Cyber Espionage Group

Diplomatic and government organizations in Brazil, Peru, Ecuador, and Argentina are being targeted by what Symantec says looks like a nation-state actor.

A shadowy threat group with nation-state capabilities has been conducting a sophisticated cyber espionage campaign against government targets in South America, a region where such attacks have been relatively rare.
The group, called Sowbug, has been active since at least early 2015 and appears primarily interested in gathering foreign policy information from diplomatic and government entities in the region, Symantec warned in a
report
published Tuesday.
The Sowbug groups victims include organizations in Brazil, Peru, Argentina, and Ecuador. In addition to South America, the hacker group has also targeted organizations in Southeast Asia and broken into government organizations in Brunei and Malaysia.
Symantec says it first spotted signs of Sowbugs activity in March 2017 when it discovered a brand new backdoor dubbed Felismus being used against a target in South East Asia. The group appears to be well-resourced and capable of infiltrating multiple targets simultaneously and maintaining a presence on their networks for extended periods. In some cases, they have remained undetected on a victims network for up to six months.
What makes the Sowbug campaign significant is its focus on South America, says Dick OBrien, security researcher at Symantec. Typically, most attacks of this nature have been directed at organizations in the United States and Europe. The most significant thing for us was seeing a group like this targeting South America, which, to date, has been quite rare, OBrien says.
The big takeaway from our perspective is that cyberespionage is now a global issue and no region is unaffected, he says. Organizations shouldnt assume they wont be targeted because of where they are located, and should build their defenses against such threats.
In terms of capabilities, the Sowbug group has developed its own sophisticated malware and seems to have enough personnel to take on multiple targets at the same time. The attackers tend to only operate outside of the normal working hours in their targeted countries to minimize their chances of getting caught. Therefore, wed view them as capable and well-resourced attackers, near the elite end of the spectrum, OBrien says.
The actors behind the Sowbug campaign appear to be looking for very specific information on victim networks. For instance, in a May 2015 attack on the foreign affairs ministry of a South American nation, the attacks seemed focused on extracting documents from a division of the ministry that was responsible for foreign relations with a nation in the Asia-Pacific region.
The threat actors first looked for and extracted all Word documents stored in a file server belonging to the division that had been modified from May 11, 2015. One hour later, they came back to the same server and extracted an additional four days worth of data. Presumably they either didnt find what they were looking for in the initial incursion, or else noticed something in the documents they stole earlier that prompted them to hunt for more information, Symantec noted in its report.
They then attempted to extract Word documents and other content from remote files shares and shared drives belonging to the targeted division, once again using a very specific date range. In this particular instance, the threat actors from Sowbug managed to remain undetected on the victim network for a period of four months between May and September 2015.
One tactic the group has used to evade detection is to disguise its malware as well-known software packages such as Windows and Adobe Reader. The group has been able to hide in plain sight by naming its tools after well-known software products and placing them in directory trees where they can easily be mistaken for the real thing, according to Symantec.
OBrien says Symantec so far has not been able to figure out how the group initially infiltrates a target system or drops the Felismus backdoor on them. In some cases, the researchers have seen the attackers employ a dropper dubbed Starloader to install Felismus. But in those cases, the company has not been able to figure out how Sowbug got the dropper on the system.
We were unable to identify any technical or operational aspects of the attack that would indicate possible origin of this activity, OBrien says. However, we can say the targets are likely of interest to a nation-state and the malware used in these attacks is at the level of sophistication we would expect to see with state-sponsored attackers.
Related content:
Nation-State Cyberthreats: Why They Hack
State-Sponsored Cybercrime: A Growing Business Threat
China-Based Threat Actor APT10 Ramps Up Cyber Espionage Activity
9 Ways Organizations Sabotage Their Own Security: Lessons from the Verizon DBIR
Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity
agenda here
.

Last News
▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂ Discovered: 23/12/2024 Category: security	▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security	▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
South America the Target of Sowbug Cyber Espionage Group