The Best Spies Money Can Buy

Security firms have found evidence that espionage agents are buying time on leased botnets: Will cybercriminals services lead to more efficient spying?

During the past decade, cybercriminals have specialized in the various tasks needed to compromise computers, steal data, and make money. Now, more elusive nation-state attackers could be using rented botnets and cybercriminal services to streamline their own operations, security experts say.
In June, security firm FireEye
detected evidence
of such a connection when it found instances of a remote-access Trojan whose code seemed to have been reused to infect machines with fake antivirus software. In another incident, cybercriminals sold access to compromised military and government computers, allowing would-be cyberspies to get direct access to their targets, says Darien Kindlund, senior staff scientist at FireEye.
The two examples are part of a building body of evidence that suggests attackers representing what the military and security industry refer to as the advanced persistent threat (APT) are not shying away from using criminals resources to help them in their missions.
If military and government hosts are being sold on the black market, who are the most likely buyers -- spammers? No, they could buy something cheaper on a different network. But for APT? Yes, it meets their mission objectives, Kindlund says.
Criminals looking to rent time on a botnet will likely try to avoid using military and government servers for fear of more intense repercussions. Yet the same servers are the targets for APT attacks, Kindlund argues. The cybercriminal element on the Internet certainly seems ready to handle sales of botnets to any comer, including espionage agents.
These malware criminals may not necessarily know that their buyers are APT actors because they provide generic, easy-to-use Web interfaces to allow anyone to rent machine time on compromised systems, Kindlund says.
McAfee acknowledges that buying hacked systems within a targeted company would be an easy way to get behind the companys defenses. Yet the company has not found much evidence of espionage agents using criminal botnets to carry out their missions, says Stuart McClure, general manager for risk compliance at McAfee. Contacting a criminal group to purchase compromised machines carries a large risk of tipping the hand of a spy, he says.
If I was the bad guy, I would go after the command-and-control servers themselves and just hack those, McClure says. Then I would figure out which systems the C&Cs had control over, and I would just take over those.
Other security firms also believe the link between cybercriminals and nation-state attackers might be fairly uncommon. Evidence linking code might not mean a common code base, but a common exploit, says Rik Ferguson, director of security research for Trend Micros Europe, Middle East, and Africa business unit.
There is very little crossover in terms of the actual Trojan malware used in espionage attacks versus criminal attacks, Ferguson says. However, there may be crossovers in terms of the vulnerabilities that cause the initial infection.
In the end, it depends on who is trying to steal information. Its unlikely that an intelligence agency will go to the only version of the mob and ask for an informant in a particular company or government office, McAfees McClure says. Instead, they will create their own tools.
At the end of the day, if you are a spy agency, you are going to develop your own stuff, he says. You may get ideas from others ... but I dont think the elite guys are ever going to do business with criminals, he says.
Yet,criminals could decide that the market for intellectual property is lucrative enough to make a profit. In that case, all bets are off, FireEyes Kindlund says.
If we look at the logical conclusion of this trend, we see that eventually different cybercrime groups emerge, each specializing in different stages of the overall business model ... [including] exfiltrated intel sales, he says.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security	▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
The Best Spies Money Can Buy