Report Shows Worldwide Attacks on Commercial Businesses and National Security Interests<\/p>\n
OSLO and SAN DIEGO, May 21, 2013<\/strong>\u00a0– Norman Shark, the global security leader in malware analysis solutions for enterprise, service providers and government, today released a report detailing a large and sophisticated cyber-attack infrastructure that appears to have originated from India.\u00a0 The attacks, conducted by private threat actors over a period of three years and still ongoing, showed no evidence of state-sponsorship but the primary purpose of the global command-and-control network appears to be intelligence gathering from a combination of national security targets and private sector companies.<\/p>\n \u201cThe data we have appears to indicate that a group of attackers based in India may have employed multiple developers tasked with delivering specific malware,\u201d commented Snorre Fagerland, head of research for Norman Shark labs in Oslo, Norway. \u201cThe organization appears to have the resources and the relationships in India to make surveillance attacks possible anywhere in the world.\u00a0 What is surprising is the extreme diversity of the sectors targeted, including natural resources, telecommunications, law, food and restaurants, and manufacturing.\u00a0 It is highly unlikely that this organization of hackers would be conducting industrial espionage for just its own purposes\u2014which makes this of considerable concern.\u201d<\/p>\n The investigation revealed evidence of professional project management practices used to design frameworks, modules, and subcomponents.\u00a0 It seems that individual malware authors were assigned certain tasks, and components were \u201coutsourced\u201d to what appear to be freelance programmers.\u00a0 \u201cSomething like this has never been documented before\u201d, Fagerland added.<\/p>\n The discovery is currently under investigation by national and international authorities.<\/p>\n The discovery began on March 17th when a Norwegian newspaper reported that Telenor, one of the world\u2019s largest mobile phone operators, a member of the world\u2019s top 500 companies, and Norway\u2019s major telecommunications company, had filed a criminal police case for an unlawful computer intrusion.\u00a0 Spear phishing emails targeting upper management appeared to be the source of the infection.<\/p>\n The behavior pattern and file structure of malware files made it possible, for security analysts at Norman Shark, to search internal and public databases for similar cases utilizing Norman Shark\u2019s Malware Analyzer G2 automatic analysis systems.\u00a0 The amount of malware found by Norman Shark analysts and their partners was surprisingly large and it became clear the Telenor intrusion was not a single attack, but part of a continuous effort to compromise governments and corporations worldwide.<\/p>\n Norman Shark titled the report \u201cOperation Hangover<\/a>\u201d after one of the cyber espionage malwares most frequently used in this case.<\/p>\n Based on an analysis of IP addresses collected from criminal data stores discovered during the investigation, it appears that potential victims have been targeted in more than a dozen countries.\u00a0 Specific targets include government, military and business organizations.\u00a0 Attribution to India was based on an extensive analysis of IP addresses, website domain registrations, and text-based identifiers contained within the malicious code itself.<\/p>\n Despite all of the recent media attention on so-called \u201czero day\u201d exploits encompassing brand new attack methods, Operation Hangover appears to have relied on well-known, previously identified vulnerabilities in Java, Word documents, and web browsers.<\/p>\n \u201cThis type of activity has been associated primarily with China over the past several years but to our knowledge, this is the first time that evidence of cyber espionage has shown to be originating from India,\u201d Fagerland concluded.\u00a0 \u201cOur study, available on the Norman Shark website (www.norman.com) provides assistance in what security teams need to look for.\u201d<\/p>\n Stein Surlien, CEO Norman SharkContact Information<\/h1>\n<\/div>\n<\/section>\n
\nMob:+ 47 911 16\u00a0240 Email:\u00a0stein.surlien@norman.com<\/a><\/p>\n