At the recent Black Hat Security Conference Dell Secureworks revealed an 18 month long investigation that can best be described as Spy vs. Spy 2.0. Computerworld reported on Dell’s research.
For 18 months Dell Secureworks researchers Joe Stewart and Don Jackson secretly monitored the command and control network of a band of Chinese cyberspies dubbed “the Beijing Group.” The Beijing runs the Comfoo RAT which is responsible for the compromise of the RSA SecurID token. SecureWorks revealed that it uncovered more than 64 campaigns which targeted over 100 victims. The attackers used more than 200 variants of the Comfoo code in these attacks. This map from Dell Secureworks shows the location of the victims.
Stewart and Jackson released a detailed report of their 18 month odyssey entitled Secrets of the Comfoo Masters.
Secrets of the Comfoo Masters provides useful incident response information and stresses the importance of a multi-layer defense. Prevention is an important layer of defense against the deceptive emails used by APT attackers to trick users into compromising their systems. Using SP Guard, IT can determine a list of trusted senders and provide this information to staff in a simple and highly effective manner.
You can contact us at 408-727-6342,ext 3 or use our online contact form.