FireEye Blog

For threat actors that target Korean users their favorite software to exploit for initial access is HWP (Hangul Word Processor). It's MS Word for Korean users. If you are being sent official docs of any kind, chances are it is a .hwp file that needs the program. Banking and internet access affects consumers but HWP is used by more interesting espionage/sabotage targets. https://www.fireeye.com/content/dam/fireeye-www/global/en/blog/threat-… I just looked up CVEs for it. I only see 2 in 2017. This is not a good thing, a complex word processor, even if it was rewritten in a memory safe language would have at least some low level non-memory vulns in 6 years!

More info on the attack here: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-… > They gained access to victims via trojanized updates to SolarWind’s Orion IT monitoring and management software. This campaign may have begun as early as Spring 2020 and is currently ongoing. Post compromise activity following this supply chain compromise has included lateral movement and data theft. The campaign is the work of a highly skilled actor and the operation was conducted with significant operational security.

Private companies like Crowdstrike would probably love to reveal their analysis however they would be restricted by the actual data owners (e.g. the DNC) and I would guess ongoing government investigations. Plus why blow all of your signatures when they still work? Outside of that, there's tons of data online already regarding Russian government hacking activity: http://researchcenter.paloaltonetworks.com/2016/06/unit42-new-sofacy-a… https://www.fireeye.com/content/dam/fireeye-www/global/en/current-thre… https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profil… http://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komp… Do you think understanding the tools, infrastructure, coding styles, activities, targets of these groups allows them to perform attribution?

NOTE: I am not recommending this group for I don't recommend in this situation, but feel compelled to mention them to address this comment as a counterexample: Mandiant was bought out by FireEye. https://www.fireeye.com/services.html I believe Sony was using them for forensics as well as establish their new more secure system. It is important to set up systems so that hackers if (and when) they do breech, are found ASAP, and only get access to compartments and not the entire company. There are also Israelis that I know of who have a good reputation in cybersecurity.

REMOTE - Mandiant/FireEye - http://mandiant.com / http://fireeye.com We're currently looking for several roles, including a junior front-end dev, Rails developers, and several security analyst positions that aren't on my team. On my team, we use Rails 4.x, PostgreSQL, Redis, etc. For the front-end role, we're looking for someone who wants to work more on the HTML/CSS implementation side of things and less so JavaScript (though JS skills will be useful). Ping me at [my HN username]@gmail.com to chat about it.

There are now some companies which provide non-signature based anti-virus detection to potentially detect zero-day malware. Most of them work by spinning up a vm, run or open the file to check, and verify any changes to the system. Check out http://www.fireeye.com/ (funded by the CIA's startup incubator In-Q-Tel) http://www.fidelissecurity.com/ (from General Dynamics) and Northrop Grumman is releasing one soon too. Not sure if I'd trust these companies more or less than the signature based companies.

I'll take this opportunity to recommend that anyone who is in security should think about going to work at FireEye. Ridiculously cool technology, and they routinely lead Botnet takedowns to boot, e.g. http://www.fireeye.com/news-events/press-releases/read/fireeye-takes-d… Email me at the email in my profile if you would like a warm intro. Disclaimer: my brother is a long-time engineer.

for example The Equation Group (https://en.wikipedia.org/wiki/Equation_Group), which wouldn't be an organic part of the function or activities of a normal civilian cyber-security company. While your basic point might be correct, this part is absolutely false. All major security groups actively research all APT groups, no matter where they are from. For example, here's a 2015 report from (US Company) FireEye[1]. Page 11 talks about the Equation Group (as well as the UK-based Regin group). It is worth acknowledging that Kaspersky was the first company to identify and name the Equation Group. However, this is likely to be because of the geographical overlap of activities: Kaspersky provides defensive support in Russia and the Middle East where the Equation Group is most active. This is exactly the same as how Mandiant/Fireeye identified ATP-1 and Cozy Bear/Fancy Bear: they get called in to investigate breaches in the US where those state-supported groups are most active. [1] https://www.fireeye.com/content/dam/fireeye-www/company/events/infosec…

MANDIANT Full Time ONSITE - TS/SCI with Polygraph Required - Annapolis Junction, MD Join an industry leading team performing challenging and meaningful work. Mandiant is supporting a critical customer mission to design, deliver, and operate a national network defense capability. We have an immediate opening for a fully-cleared mid to senior Incident Response and Malware Analysis Consultant to provide ongoing breach detection, threat analysis, incident response, and malware analysis. This is an evolving program and provides a great opportunity to influence its progression. The ideal candidate will be fully cleared, have strong industry experience in developing and operating next generation defensive cyber operations to help improve the customer's breach detection and mitigation capabilities, excellent communication and presentation skills with the ability to present to a variety of external audiences, capable of managing multiple tasks and priorities with divergent schedules, proactive and amicable personality, but also does not back down in the face of adversity, and has an understanding that this program is in its infancy and you will play a large role in development and refinement of its analysis and operations capability. What we can offer you: Great salary and incentives, internal training and conference opportunities, encouragement and support for speaking engagements, and career flexibility (though we ask for at least a year at this customer) If you are…

https://www.fireeye.com/cyber-map/threat-map.html Or build your own: https://github.com/hrbrmstr/pewpew :)

RIP Zerohedge. What possibly happened to ZH, and what you're discussing, has a good operational walkthrough here - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/Ghostwriter-…

The hackers targeted Iranian groups too. Makes you wonder who China’s real allies are. https://www.fireeye.com/blog/threat-research/2021/08/unc215-chinese-es…

APT 40 and 31 are well documented [1] [2]. [1] https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a… [2] https://research.checkpoint.com/2021/the-story-of-jian/

https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-… You are vastly underestimating the lengths that this attack when to avoid detection. They didn't just hijack Solarwinds updates and inject malware. They did things like concealing the commands of malware in legitimate looking Solarwinds packets. When they infiltrated a place, they had the malware sleep for months. They carefully avoid standard malware detection techniques and you can only do that if you have very sophisticated engineers. This isn't just some scripts someone pulled from the internet.

The supply chain compromise does not appear to be sophisticated. The "post installation of compromised software" activity seems to be somewhat sophisticated. https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-… No high school kid is doing that.

It's not a zero sum game. It is interesting in that it marks the first _wide spread_ attack on a supply chain via cyber space. The malware's DNS signaling protocol is pretty neat, which you can look at here: https://www.fireeye.com/blog/threat-research/2020/12/sunburst-addition…

related blog post: https://www.fireeye.com/blog/threat-research/2021/01/remediation-and-h…

It's not just the initial compromise that's getting "sophisticated hack" headlines in this case -- it's the extraordinary care that the attackers took to evade detection afterwards. Among other things: delaying communication to home base for a couple of weeks after the backdoor was initially installed; use of steganography to make that look like ordinary network traffic afterwards; use of entirely new exploits, not in any common database, to avoid detection triggered by a match. The FireEye report describes all of this in more detail: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-…

Here’s the FireEye write up: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-…

Your comment didn't age well. https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-… If this is not sophisticated, I don't know what is.

Official blog post (no info on how the attack was performed though): https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-sha… They’ve also released signatures to detect the use of the compromised tools: https://github.com/fireeye/red_team_tool_countermeasures

FireEye's own blog post is up: https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-acce… As is the GitHub repo with their red team tool countermeasures, which they admirably released immediately: https://github.com/fireeye/red_team_tool_countermeasures/

FireEye has provided their own evidence[1]. BBC has strong editorial guidelines for dealing with evidence from third-parties[2]. You, however, have provided nothing but conjecture and redirection. Can you substantiate your claim? If not, it’s fair to classify your comments as obvious attempts to gaslight HN’s readers. 1: https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/Ghostwriter-… 2: https://www.bbc.co.uk/editorialguidelines/guidelines/accuracy/guidelin…

Check out Mandiant's summary on APT1 [0]. Two brief excerpts from that report: -APT1 is believed to be the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department (总参三部二局), which is most commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398 (61398部队). -APT1 has systematically stolen hundreds of terabytes of data from at least 141 organizations, and has demonstrated the capability and intent to steal from dozens of organizations simultaneously. [0] https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant…

> legitimate sites that don't run malicious advertising That's the problem. There are plenty of legitimate sites that have run malicious advertising because they used an ad network that ended up allowing one. Like Forbes: https://www.fireeye.com/blog/threat-research/2015/09/malvertising_atta… So as a precaution, no. Today's totally safe ad is tomorrow's malvertising.

Details: https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-par…

The government sponsored professional hacking team that was mentioned in the article was the focus of the infamous APT1 report by Mandiant (now FireEye), with investigations from 2006 and later: https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant… There have been many APT groups named and tracked since then, not just in China.

Here's the direct link to the report: https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-… Article spends too much time FUDing "plant explosions" for my taste

Made in Russia? https://www.fireeye.com/blog/threat-research/2018/10/triton-attributio…

From https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-… >The targeting of critical infrastructure to disrupt, degrade, or destroy systems is consistent with numerous attack and reconnaissance activities carried out globally by Russian, Iranian, North Korean, U.S., and Israeli nation state actors. Intrusions of this nature do not necessarily indicate an immediate intent to disrupt targeted systems, and may be preparation for a contingency. This reeks of Stuxnet 2.0