Gather around the watering hole: Bronze Union attackers likely based in China

A China-based espionage group may be responsible for targeting Turkey's high profile government and private sector networks, in addition to other attacks on organisations in the UK, US and Canada.

The Bronze Union group, believed to be operating from China, has been active since 2015. The group was originally responsible for attacks on various sectors including government, technology, media and aerospace organisations.

In late 2016 the group heavily targeted high-profile Turkish organisations over an eight-day period. Five banks, two academic networks and 17 Turkish government IP addresses downloaded the group's malware.

The attack on Turkey is suspected to be an effort to take advantage of the country's political, economic and military ties to Europe and the Middle East.

According to SecureWorks, the group is still an 'active and formidable group', capable of large-scale intrusion attacks against high-profile systems.

The group uses watering hole attacks, also known as strategic web compromises to infiltrate networks. Researchers have also found that the group is now finding vulnerable internet-facing service to find networks and infiltrate them.

The group has been able to quickly understand infiltrated networks, disable logging and delete individual logs. Through watering holes, the group can collect credentials escalate privilege and deploy web shells.

Researchers also found that the Bronze Union group uses watering holes and scan-and-exploit techniques to deliver malware to systems. The group has also been able to bank on previously compromised websites to further its malware spread.

When the group was blocked from accessing a compromised environment, they tried to reconnect to its web shells using account credentials that may have come from an earlier attack phase.

Notably, the group also took advantage of other infrastructure. Researchers suspect this is to legitimise re-entry attempts, and it shows that there must be constant vigilance about possible re-entry attacks.

While the group is targeting specific industries and organisations, SecureWorks researchers suggest that all users take care to prevent attacks.

"To mitigate these threats, CTU researchers recommend that clients conduct regular internal vulnerability scanning, patching, and upgrading of priority systems, particularly Internet-facing systems and users' devices," the SecureWorks blog says.

Advanced endpoint threat detection will be able to suspicious activity that may indicate web shells or lateral movement, while sandboxing can stop malicious traffic from penetrating networks.

"Early detection and response can minimize exposure and damage."