Story image

Gather around the watering hole: Bronze Union attackers likely based in China

04 Jul 17

A China-based espionage group may be responsible for targeting Turkey's high profile government and private sector networks, in addition to other attacks on organisations in the UK, US and Canada.

The Bronze Union group, believed to be operating from China, has been active since 2015. The group was originally responsible for attacks on various sectors including government, technology, media and aerospace organisations.

In late 2016 the group heavily targeted high-profile Turkish organisations over an eight-day period. Five banks, two academic networks and 17 Turkish government IP addresses downloaded the group's malware.

The attack on Turkey is suspected to be an effort to take advantage of the country's political, economic and military ties to Europe and the Middle East.

According to SecureWorks, the group is still an 'active and formidable group', capable of large-scale intrusion attacks against high-profile systems.

The group uses watering hole attacks, also known as strategic web compromises to infiltrate networks. Researchers have also found that the group is now finding vulnerable internet-facing service to find networks and infiltrate them.

The group has been able to quickly understand infiltrated networks, disable logging and delete individual logs. Through watering holes, the group can collect credentials escalate privilege and deploy web shells.

Researchers also found that the Bronze Union group uses watering holes and scan-and-exploit techniques to deliver malware to systems. The group has also been able to bank on previously compromised websites to further its malware spread.

When the group was blocked from accessing a compromised environment, they tried to reconnect to its web shells using account credentials that may have come from an earlier attack phase.

Notably, the group also took advantage of other infrastructure. Researchers suspect this is to legitimise re-entry attempts, and it shows that there must be constant vigilance about possible re-entry attacks.

While the group is targeting specific industries and organisations, SecureWorks researchers suggest that all users take care to prevent attacks.

"To mitigate these threats, CTU researchers recommend that clients conduct regular internal vulnerability scanning, patching, and upgrading of priority systems, particularly Internet-facing systems and users' devices," the SecureWorks blog says.

Advanced endpoint threat detection will be able to suspicious activity that may indicate web shells or lateral movement, while sandboxing can stop malicious traffic from penetrating networks.

"Early detection and response can minimize exposure and damage."

Twitter suspects state-sponsored ties to support forum breach
One of Twitter’s support forums was hit by a data breach that may have ties to a state-sponsored attack, however users' personal data was exposed.
How McAfee aims to curb enterprise data loss
McAfee DLP aims to help safeguard intellectual property and ensure compliance by protecting sensitive data.
2018 sees 1,500% increase in coinmining malware - report
This issue will only continue to grow as IoT forms the foundation of connected devices and smart city grids.
2019 threat landscape predictions - Proofpoint
Proofpoint researchers have looked ahead at the trends and events likely to shape the threat landscape in the year to come.
Mac malware on WatchGuard’s top ten list for first time
The report is based on data from active WatchGuard Firebox unified threat management appliances and covers the major malware campaigns.
Bin 'em: Those bomb threat emails are complete hoaxes
A worldwide spate of spam emails claiming there is a bomb in the recipient’s building is almost certainly a hoax.
Marriott sets up call centres to answer questions on data breach
Marriott has released an update on the breach of the Starwood guest reservation data breach which affected 500 million guests.
Why there will be a battle for the cloud in 2019
Cloud providers such as AWS, Azure, and Google will likely find themselves in a mad scramble to gain additional enterprise customers.