1 min read

Under Siege for Months: the Anatomy of an Industrial Espionage Operation

Ad One product to protect all your devices, without slowing them down.
Free 90-day trial
Under Siege for Months: the Anatomy of an Industrial Espionage Operation

Providing security to customers is a complex and resource-intensive endeavor in a complex world of deeply integrated technologies. As part of our commitment to keeping customers safe, we often complement our security stack offerings with managed detection and response, threat hunting and constant monitoring of customer infrastructure. The Cyber-Threat Intelligence Lab keeps a close eye on alerts and EDR reports coming from infrastructure, helping owners and maintainers navigate the early stages of compromise.

This is the case of an incident we worked on with a technology partner in the United States of America.

We identified a complex kill chain and monitored the attack through various stages to assess the extent of the breach and help the customer regain control of the network. We are releasing this research paper to help other decision-makers cover their blind spots and improve their overall security posture.

Attack at a Glance

  • Attackers managed to compromise a Patient Zero computer and used it to establish a secondary access avenue through a web shell planted on the company’s Exchange Server
  • This attack was focused on information exfiltration and spans on several months
  • During the scouting process, the threat actor managed to gain access to the company’s intellectual property and download source code from several GIT repositories
  • The group have used a network of over 650 IPs to access the company infrastructure for the duration of the attack. The vast majority of IP addresses can be traced back to China.

Download the whitepaper

Indicators of Compromise

An up-to-date and complete list of indicators of compromise is available to Bitdefender Advanced Threat Intelligence users. The currently known indicators of compromise can be found in the whitepaper below.

Recommendations

  • Introduce cybersecurity awareness training for employees to help them spot phishing e-mails.
  • Tune the e-mail security solution to automatically discard malicious or suspicious attachments.
  • Integrate threat intelligence into existing SIEM or security controls for relevant Indicators of Compromise.
  • Small and medium organizations without a dedicated security team should consider outsourcing security operations to Managed Detection and Response providers.

tags


Author



Right now

Top posts

A Red Team Perspective on the Device42 Asset Management Appliance

A Red Team Perspective on the Device42 Asset Management Appliance

August 10, 2022

1 min read
Vulnerabilities Identified in Wyze Cam IoT Device

Vulnerabilities Identified in Wyze Cam IoT Device

March 29, 2022

1 min read
New FluBot and TeaBot Global Malware Campaigns Discovered

New FluBot and TeaBot Global Malware Campaigns Discovered

January 26, 2022

10 min read
Bitdefender Honeypots Signal Active Log4Shell 0-Day Attacks Underway; Patch Immediately

Bitdefender Honeypots Signal Active Log4Shell 0-Day Attacks Underway; Patch Immediately

December 10, 2021

2 min read
Bitdefender, Law Enforcement Partnership Saves REvil Victims Half a Billion in Ransom Demand

Bitdefender, Law Enforcement Partnership Saves REvil Victims Half a Billion in Ransom Demand

November 08, 2021

2 min read
Bitdefender Offers Free Universal Decryptor for REvil/Sodinokibi Ransomware

Bitdefender Offers Free Universal Decryptor for REvil/Sodinokibi Ransomware

September 16, 2021

2 min read

FOLLOW US ON

SOCIAL MEDIA


You might also like

Android SharkBot Droppers on Google Play Underline Platform's Security Needs Android SharkBot Droppers on Google Play Underline Platform's Security Needs
Elena FLONDORAlbert ENDRE-LASZLOVlad Sebastian CREȚUAdina MATEESCUAlexandra BOCEREGSilviu STAHIE
5 min read
Side-Loading OneDrive for profit – Cryptojacking campaign detected in the wild Side-Loading OneDrive for profit – Cryptojacking campaign detected in the wild
Balint SZABOJanos Gergo SZELES
1 min read
Under Siege for Months: the Anatomy of an Industrial Espionage Operation Under Siege for Months: the Anatomy of an Industrial Espionage Operation
Alexandru MAXIMCIUCVictor VRABIE
1 min read