#duqu

Sfetcu, Nicolae (2024), Studii de caz privind atacurile cibernetice – Amenințările persistente avansate, IT & C, 3:1, ppp,   Cyber Attack Case Studies – Advanced Persistent Threats Abstract In the rapidly evolving technology landscape, the proliferation of cyberattacks has become a pervasive threat, permeating every sector of society. From government institutions to private businesses and…

The Regin malware campaign targeted international organizations from 2008 to 2011 and from 2013-2014. The malware may have remained undiscovered for at least five years prior to 2008. The complexity of the toolkit suggests the investment of significant resources over several years. In support of this assumption, Symantec notes that Regin malware appears to be designed for espionage campaigns that last several years. The malware is allegedly the product of a collaboration between the United States NSA and the British GCHQ. This allegation derives from a document leaked to Der Spiegel and the Intercept by Edward Snowden. The malware primarily targeted systems belonging to private individuals, small businesses, and telecommunications companies in Russia, Saudi Arabia, Mexico, Ireland, and to a lesser extent, India, Afghanistan, Iran, Belgium, Austria, and Pakistan.

The Regin malware campaign targeted international organizations from 2008 to 2011 and from 2013-2014. The malware may have remained undiscovered for at least five years prior to 2008. The complexity of the toolkit suggests the investment of significant resources over several years. In support of this assumption, Symantec notes that Regin malware appears to be designed for espionage campaigns that last several years. The malware is allegedly the product of a collaboration between the United States NSA and the British GCHQ. This allegation derives from a document leaked to Der Spiegel and the Intercept by Edward Snowden. The malware primarily targeted systems belonging to private individuals, small businesses, and telecommunications companies in Russia, Saudi Arabia, Mexico, Ireland, and to a lesser extent, India, Afghanistan, Iran, Belgium, Austria, and Pakistan.

According to Kaspersky Lab, the Dark Hotel group may have been stealing confidential documents out of the secured computers of travelling executives since 2007. Researchers believe that the group is Korean in origin (in part) because variants of the malware were designed to shut down and remove itself from the host system if the infected system code page was set to Korean. Further, the kernel mode keylogger used in Dark Hotel group attacks has Korean characters in its code and may be tied to a South Korean programmer. Since the group still targets North Koreans, one could suppose the Dark Hotel group originates in South Korea. The Dark Hotel group attack campaigns use a sophisticated keylogger and extensive infrastructure to steal confidential information directly relevant to South Korea from employees of other nations. Consequently, there is a strong likelihood that Dark Hotel group is a partially or fully state sponsored threat actor. Dark Hotel group associated names are Tapaoux, Nemim, Pioneer, Karba. The Dark Hotel group targets high-profile executives, sales and marketing employees, R&D staff, and government employees from North Korea, Japan, India, and the United States. Notably, targets tend to be from the Asian nations with nuclear capabilities and the Unites States. Dark Hotel group often targets guests staying at luxury hotels in Asia. A smaller number of hotels in the United States have also been infected. Overall, fewer than two dozen hotel network compromises have been discovered, but it is possible that many breaches remain undiscovered or unreported. Hotels appear to be targeted based on the expectation that specific individuals will be staying there in the near future. Evidence suggests that the adversary possesses knowledge of the personal information of targets, at which hotel individual targets will stay, and the duration of their stay. The attacks may target specific individuals or all individuals who try to connect within a specific period. It is possible that the hotel attacks target those unlikely to fall for a spear phishing campaign. Specific targets may be located based on their Wi-Fi connection in the network, which is often secured with a password created from their surname and room number. Either the actor targets the hotel network directly or on occasion, it compromises the third party that manages the Wi-Fi for multiple hotels. The malware is distributed across the network either before the staff arrives to work or after they leave. When the target concludes their stay, the adversary removes all or most traces of the attack from the hotel network. Neither backdoors nor tools are left behind.