Story image

Gather around the watering hole: Bronze Union attackers likely based in China

04 Jul 17

A China-based espionage group may be responsible for targeting Turkey's high profile government and private sector networks, in addition to other attacks on organisations in the UK, US and Canada.

The Bronze Union group, believed to be operating from China, has been active since 2015. The group was originally responsible for attacks on various sectors including government, technology, media and aerospace organisations.

In late 2016 the group heavily targeted high-profile Turkish organisations over an eight-day period. Five banks, two academic networks and 17 Turkish government IP addresses downloaded the group's malware.

The attack on Turkey is suspected to be an effort to take advantage of the country's political, economic and military ties to Europe and the Middle East.

According to SecureWorks, the group is still an 'active and formidable group', capable of large-scale intrusion attacks against high-profile systems.

The group uses watering hole attacks, also known as strategic web compromises to infiltrate networks. Researchers have also found that the group is now finding vulnerable internet-facing service to find networks and infiltrate them.

The group has been able to quickly understand infiltrated networks, disable logging and delete individual logs. Through watering holes, the group can collect credentials escalate privilege and deploy web shells.

Researchers also found that the Bronze Union group uses watering holes and scan-and-exploit techniques to deliver malware to systems. The group has also been able to bank on previously compromised websites to further its malware spread.

When the group was blocked from accessing a compromised environment, they tried to reconnect to its web shells using account credentials that may have come from an earlier attack phase.

Notably, the group also took advantage of other infrastructure. Researchers suspect this is to legitimise re-entry attempts, and it shows that there must be constant vigilance about possible re-entry attacks.

While the group is targeting specific industries and organisations, SecureWorks researchers suggest that all users take care to prevent attacks.

"To mitigate these threats, CTU researchers recommend that clients conduct regular internal vulnerability scanning, patching, and upgrading of priority systems, particularly Internet-facing systems and users' devices," the SecureWorks blog says.

Advanced endpoint threat detection will be able to suspicious activity that may indicate web shells or lateral movement, while sandboxing can stop malicious traffic from penetrating networks.

"Early detection and response can minimize exposure and damage."

Disruption in the supply chain: Why IT resilience is a collective responsibility
"A truly resilient organisation will invest in building strong relationships while the sun shines so they can draw on goodwill when it rains."
Businesses too slow on attack detection – CrowdStrike
The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 cases.
Proofpoint launches feature to identify most targeted users
“One of the largest security industry misconceptions is that most cyberattacks target top executives and management.”
McAfee named Leader in Magic Quadrant an eighth time
The company has been once again named as a Leader in the Gartner Magic Quadrant for Security Information and Event Management.
Symantec and Fortinet partner for integration
The partnership will deliver essential security controls across endpoint, network, and cloud environments.
Is Supermicro innocent? 3rd party test finds no malicious hardware
One of the larger scandals within IT circles took place this year with Bloomberg firing shots at Supermicro - now Supermicro is firing back.
25% of malicious emails still make it through to recipients
Popular email security programmes may fail to detect as much as 25% of all emails with malicious or dangerous attachments, a study from Mimecast says.
Google Cloud, Palo Alto Networks extend partnership
Google Cloud and Palo Alto Networks have extended their partnership to include more security features and customer support for all major public clouds.