Microsoft has taken steps to stop a Chinese hacking group from using its TechNet website as part of its attack infrastructure, according to security vendor FireEye.
The group, which FireEye calls an APT (advanced persistent threat) 17, is known for its attacks against arms suppliers, law firms, US government agencies, and technology and mining companies.
TechNet is a highly commercial website that has the technical report for Microsoft products. It also has a large forum where users can leave comments and ask their questions.
The APT17 group – under the alias DeputyDog – created accounts on TechNet and then left comments on certain pages. Those comments contained the name of a coded domain, which directed computers infected with the malware the group had created.
The encrypted domain then pointed the victim's computer to a command-and-control server that was part of APT17's infrastructure, Bryce Boland, FireEye's chief technology officer for Asia Pacific, said in a statement.
The technique of having an infected computer communicate with an intermediate domain is often used. Often, hackers want infected machines to reach a domain that is unlikely to look suspicious before moving on to another, less trusted one.
Sometimes, command-and-control domains are embedded in the malware itself, but that makes it easier for security researchers to figure out who it's communicating with. Other times, the malware is coded with an algorithm that generates possible domain names it should communicate with, but that can also be reverse engineered by analysts, Boland says.
Security experts have seen attackers misuse other legitimate domains and services, such as Google Docs and Twitter, to achieve the same goal as APT17, Boland said.
FireEye and Microsoft replaced the coded domains on TechNet with those controlled by the businesses, which gave them insight into the problem when infected machines contacted those domains.
APT17 are typically targeted through spear-phishing - which involves sending emails with malicious links or attachments.
