Darkhotel Attackers Target CEOs
Hackers have developed a scheme to steal sensitive information from top executives by penetrating the Wi-Fi networks of luxury hotels, security researchers said Monday.
Dubbed the "Darkhotel APT," the threat actors use three different malware distribution methods, including malicious Wi-Fi networks, booby-trapped P2P torrents, and highly customized spear phishing, Kaspersky Lab noted in research paper.
Kaspersky said about 90 percent of the infections appear to be located in Japan, Taiwan, China, Russia and South Korea, but that the executives targeted include those traveling from the United States and other countries.
"The more interesting traveling targets include top executives from the US and Asia doing business and investment in the (Asia-Pacific) region."
The attackers’ methods include the use of zero-day exploits to target executives in spear-phishing attacks as well as a kernel-mode keystroke logger to siphon data from victim machines. They also managed to crack weak digital signing keys to generate certificates for signing their malware, in order to make malicious files appear to be legitimate software.
“Obviously, we’re not dealing with an average actor,” says Raiu. “This is a top-class threat actor. Their ability to do the kernel-mode key logger is rare, the reverse engineering of the certificate, the leveraging of zero days—that puts them in a special category.”
These types of attacks were first recorded in 2007, but activity spiked in August 2010 and has continued through to this year, the research found. Executives from electronics makers, pharmaceutical companies and military organizations were among the targets.
The key-logging tool's code is written in Korean, but Kaspersky said this did not necessarily mean the hackers were from Korea. It was also difficult at this stage in the investigation to tell if the attacks were state-backed, Raiu added.
The number of hotels that have been hit is also unknown. So far the researchers have found fewer than a dozen hotels with infection indicators. “Maybe there are some hotels that … use to be infected and we just cannot learn about that because there are no traces,” the network-management executive says.
The company worked with Kaspersky to scour all of the hotel servers it manages for any traces of malware and are “fairly confident that the malware doesn’t sit on any hotel server today.” But that is just one network-management company. Presumably, the DarkHotel operation is still active on other networks.
~
mercredi 12 novembre 2014
0
commentaires
Articles
