Kaspersky and Symantec have issued two separate warnings about the return of the notorious Morpho hacking group, also known as Wild Neutron. The group specifically targets large companies, which brings them high financial profits.
The group was first detected in 2011, and reportedly carried out very serious attacks on Twitter, Facebook, Apple, and Microsoft in a short period of time, using a Java zero-day exploit.
Morpho appears to be an international hacking group, focused on hits that bring them financial gain.
After a short period of calm, Kaspersky and Symantec have revealed new attacks that appear to come from them.
"The attackers appear to be motivated by financial gain, using the information for their own benefit or to sell it to third parties," Symantec says.
“The focus of these attacks suggests that it is not a group sponsored by any state or nation,” adds Kaspersky, which then reports that in the malware it analyzed it detected English, Russian and Romanian.
On a technical level, these new attacks appear to use a combination of an unknown (zero-day) Flash Player exploit and a stolen Acer certificate that signs the malware code.
These allow attackers to gain access to computers, and then collect sensitive data or take full control of various services.
To obtain the data, the Morpho team uses custom OpenSSH tunnel backdoors, protected by an encrypted RSA private key.
The new attacks were detected in 2014 and 2015, targeting IT, real estate, and investment firms in the United States, France, Germany, Switzerland, Russia, Austria, the United Arab Emirates, Slovenia, and Kazakhstan, Kaspersky said. Symantec also reported attacks on Canadian companies.
