Kaspersky: APT cyber wars – Spy Vs. Spy
Kaspersky has identified a rare and unusual case of one cybercriminal attacking another.
In 2014, Hellsing, a small and moderately technical cyberespionage group that primarily targeted governments and diplomatic organizations in Asia, was spearphished by another online threat actor and decided to fight back.
Kaspersky believes this could signal the emergence of a new trend in digital crime: “APT wars.”
The discovery was made by Kaspersky Lab experts, as part of research regarding the activity of Naikon, a digital espionage group that also operated in the Asia – Pacific region. The experts observed that a Spy from the targets had detected the fact that the Naikon group attempted to «infect» his systems, via a spearphishing email that carried a malicious attachment.
The target questioned the authenticity of the email addressed to the sender and apparently dissatisfied with the response he received, did not open the attached file. A little later, the target transmitted to the sender an email that contained the target's own malicious software. This move triggered the investigation by Kaspersky Lab and led to the discovery of the APT (Advanced Persistent Threat) group Hellsing.
The method of the counterattack shows that the Hellsing team wanted to identify the Naikon team and gather information about it.
Moving into a deeper analysis of the Hellsing vector, Kaspersky Lab discovered a series of spearphishing messages with malicious attachments, which were designed to spread spyware to various organizations. If the victim opens the malicious attachment, their system is “infected” with a custom backdoor, which can “download” and “upload” files, update itself, and uninstall itself. According to Kaspersky Lab’s observations, the number of organizations targeted by Hellsing approached 20.
The objectives of Hellsing according to Kaspersky were in Malaysia, the Philippines, India, Indonesia and the USA and were mainly governmental and diplomatic organizations.
