A quiet, professional cyberespionage group steals what every company wants to keep secret: valuable information that drives business. Welcome to the new normal.
Corporate cyberespionage made the front page yesterday with the news of Morpho, also known as Wild Neutron. Regardless of what you call it, these revelations were the latest reminder of the growing prominence of corporate espionage on the cyber landscape. The group targets major IT, pharmaceutical, legal and commodity companies spanning the globe, with concentrated efforts in the United States, Europe and Canada. They are highly organized, and hone in on victims to gather confidential information for future monetization.
The quick and dirty on how Morpho operates: the group’s modus operandi is a combination of watering hole attacks, zero-day exploits and multi-platform malware. They compromise websites pertinent to the target, exploit them and deliver either a Java-based zero-day exploit or a potential Internet Explorer zero-day exploit. Bottom line: this is cyberespionage via zero-day.
What we can draw from this is that they either have the technical know-how to discover zero-days— which is unlikely for a small group, as Morpho is suspected to be — or, they have the resources to purchase zero-day exploits on the black market. Such a reliance on what we refer to as the Cybercrime-as-a-Service marketplace would reinforce our assertion that if you are well-resourced, the “services” are available to get into the cybercrime game.
Morpho used custom Remote Access Tools (RATs) to sniff for targeted information, or other computers to infect. This group also installed backdoors allowing infected machines to communicate with C&C servers over encrypted connections. The smartest thing this group did, however, was clean up after itself – once emails and confidential information was stolen, they securely deleted files and event logs. It was as if they had never broken in.
It’s because of this careful cleanup and precise execution of zero-days, that Morpho has successfully operated since 2011. But, Morpho’s success can be attributed to one thing above all: its single-minded and professional approach to compromising, extracting and leveraging business confidential information (BCI) and intellectual property (IP).
Each is valuable to hackers and can spell trouble for any business if they are lost to competitors.
Intellectual property, any work or invention originating from a creative source—from art, books, designs, images, logos, and company names, to source code, product designs, pharmaceutical formulas, to building blue prints — is as much an asset as financial resources, property, or physical product. Massive resources are allocated to developing complex products and unique concepts the loss of which constitutes billions to companies working to develop ideas that boldly impact the future.
Large industries, like pharmaceutical, chemical, and technology — the very industries targeted by Morpho — are popular targets because their IP is easily reproduced or monetized. But smaller, disruptive companies, developing new ideas, technologies, and products to challenge existing businesses and entire industries, are by no means immune to such cyber-attacks.
To what cost? That’s difficult to quantify for obvious reasons. If a factory burns down, a public company is obligated to reflect that loss in its financial statements. Cyberespionage crimes are as difficult to quantify in cost as they often are to detect. But the U.S. Department of Commerce has estimated IP theft of all kinds (not just cybercrime) as a $200 to $250 billion annual hit to U.S. companies. The Organization for Economic Development (OECD) estimates that counterfeiting and piracy costs companies as much as $638 billion a year. Such numbers have prompted McAfee Labs to conclude that cyberespionage breaches are the “Crimes of the Century”—they impact both society’s present and future economics and progress.
Business confidential information could include investment data, resource exploration data, and sensitive commercial data such as trade secrets, processes, contracts, and operational information — is almost always valuable and actionable, making it an attractive target.
Not too long ago, business confidential information was at the center of a sport-related cyberespionage involving two professional baseball teams: St. Louis Cardinals and Houston Astros. As we saw there and are seeing again with Morpho, information pertinent to business plans, contracts, and transactions is as valuable a commodity (if not more so) than intellectual property. By gaining access to confidential information, Morpho and similar cybercriminals gain insight into an organization, discovering information that can be leveraged to pre-empt critical business transactions, product announcements, and investment news.
The Morpho group has succeeded because they have laser-like precision in what they’re looking for and how they go about getting it. Regardless of intention, tactics used, or business model, the main point is that one key common denominator is driving this sort of cybercrime: the value of information that drives business.
And, as the world’s economies grow increasingly dependent on information as critical capital, cyberespionage is simply part of the global competitive landscape upon which businesses are competing today. The Morpho and Wild Neutron revelations suggest that any other assessment by executive suites—anything less than the business critical need to protect IP and BCI—is dangerously naïve.
For more information on the cost of cybercrimes such as espionage, please see McAfee report with the Center for Strategic and International Studies (CSIS) on the economic impacts of cybercrime and cyberespionage.
View the original post on Dark Reading.
Stay Updated
Follow us to stay updated on all things McAfee and on top of the latest consumer and mobile security threats.
