Story image

Gather around the watering hole: Bronze Union attackers likely based in China

04 Jul 2017

A China-based espionage group may be responsible for targeting Turkey's high profile government and private sector networks, in addition to other attacks on organisations in the UK, US and Canada.

The Bronze Union group, believed to be operating from China, has been active since 2015. The group was originally responsible for attacks on various sectors including government, technology, media and aerospace organisations.

In late 2016 the group heavily targeted high-profile Turkish organisations over an eight-day period. Five banks, two academic networks and 17 Turkish government IP addresses downloaded the group's malware.

The attack on Turkey is suspected to be an effort to take advantage of the country's political, economic and military ties to Europe and the Middle East.

According to SecureWorks, the group is still an 'active and formidable group', capable of large-scale intrusion attacks against high-profile systems.

The group uses watering hole attacks, also known as strategic web compromises to infiltrate networks. Researchers have also found that the group is now finding vulnerable internet-facing service to find networks and infiltrate them.

The group has been able to quickly understand infiltrated networks, disable logging and delete individual logs. Through watering holes, the group can collect credentials escalate privilege and deploy web shells.

Researchers also found that the Bronze Union group uses watering holes and scan-and-exploit techniques to deliver malware to systems. The group has also been able to bank on previously compromised websites to further its malware spread.

When the group was blocked from accessing a compromised environment, they tried to reconnect to its web shells using account credentials that may have come from an earlier attack phase.

Notably, the group also took advantage of other infrastructure. Researchers suspect this is to legitimise re-entry attempts, and it shows that there must be constant vigilance about possible re-entry attacks.

While the group is targeting specific industries and organisations, SecureWorks researchers suggest that all users take care to prevent attacks.

"To mitigate these threats, CTU researchers recommend that clients conduct regular internal vulnerability scanning, patching, and upgrading of priority systems, particularly Internet-facing systems and users' devices," the SecureWorks blog says.

Advanced endpoint threat detection will be able to suspicious activity that may indicate web shells or lateral movement, while sandboxing can stop malicious traffic from penetrating networks.

"Early detection and response can minimize exposure and damage."

Google puts Huawei on the Android naughty list
Google has apparently suspended Huawei’s licence to use the full Android platform, according to media reports.
Using data science to improve threat prevention
With a large amount of good quality data and strong algorithms, companies can develop highly effective protective measures.
General staff don’t get tech jargon - expert says time to ditch it
There's a serious gap between IT pros and general staff, and this expert says it's on the people in IT to bridge it.
ZombieLoad: Another batch of flaws affect Intel chips
“This flaw can be weaponised in highly targeted attacks that would normally require system-wide privileges or a complete subversion of the operating system."
Forget endpoints—it’s time to secure people instead
Security used to be much simpler: employees would log in to their PC at the beginning of the working day and log off at the end. That PC wasn’t going anywhere, as it was way too heavy to lug around.
DimData: Fear finally setting in amongst vulnerable orgs
New data ranking the ‘cybermaturity’ of organisations reveals the most commonly targeted sectors are also the most prepared to deal with the ever-evolving threat landscape.
IXUP goes "post-quantum" with security tech upgrade
The secure analytics company has also partnered with Deloitte as a reseller, and launched a SaaS offering on Microsoft Azure.
ExtraHop’s new partner program for enterprise security
New accreditations and partner portal enable channel partners to fast-track their expertise and build their security businesses.