Operation Dust Storm for Targeted Attacks against Japanese Critical Infrastructures

Security researchers recently exposed one targeted attack scheme worldwide spanning 6-yrs that sought to collect sensitive information stored at prominent crucial infrastructure companies, especially those inside Japan. The experts report about assaults on Japanese public as well as private organizations that include one reputable automaker, a Japanese subsidiary firm to one renowned South Korean electricity provider, established locally, and one firm belonging to the industry of oil-and-gas, among others.

They (security experts) name the attack Operation Dust Storm. These attacks reportedly involve phishing lures associated with the latest events. In 2015, the attackers' gang hacked into the Japanese automaker, enforcing one backdoor. The particular assault was executed 2 weeks before a countrywide auto union call demanding a 6,000 Yen increase per month.

The report also contains the latest research by SPEAR that indicates that the cyber-attackers, still not identified, moved their aim at exclusive and specific target organizations in Japan alternatively Japanese subsidiaries to bigger foreign companies. Zdnet.com posted this, February 23, 2016.

It does not seem that the attackers sought to sabotage critical infrastructure just as what lately took place during December to electric grids within Ukraine. There, the criminals' destruction disrupted power to numerous consumers emphasizing the susceptibility of crucial infrastructures connected to the Internet.

Rather according to Fitzgerald, the gang concentrated on espionage and reconnaissance, while enabling themselves a long time hold over networks. Following this time-span when quietness persisted, Operation Dust Storm returned ever strong, while following several uncomplicated watering hole assaults through a zero-day exploit in Internet Explorer, during 2014, the attackers began moving their efforts mostly against companies in Japan since February 15.

The period as well happened to be when the gang began utilizing like never before a backdoor called S-Type along with spying tools that attacked Android devices. As researchers from Cylance elaborate the campaign employed malware tailored to target specific organizations. Further, the attacks involved waterholes, spear phishing, distinct zero-day variants, distinct backdoors, and more for hacking Android mobiles and corporate networks.

As per SPEAR's research, the gang's evolution has occurred silently in the above way for remaining effective while eluding anti-virus firms' detection.

» SPAMfighter News - 3/2/2016