Chinese cyber-security vendor Qihoo 360 published a report on Friday exposing an extensive hacking operation targeting the country of Kazakhstan.
Targets included individuals and organizations involving all walks of life, such as government agencies, military personnel, foreign diplomats, researchers, journalists, private companies, the educational sector, religious figures, government dissidents, and foreign diplomats alike.
The campaign, Qihoo 360 said, was broad, and appears to have been carried by a threat actor with considerable resources, and one who had the ability to develop their private hacking tools, buy expensive spyware off the surveillance market, and even invest in radio communications interception hardware.
Signs point that some attacks relied on sending targets carefully crafted emails carrying malicious attachments (spear-phishing), while others relied on getting physical access to devices, suggesting the use of on-the-ground operatives deployed in Kazakhstan.
Meet Golden Falcon
Qihoo researchers named the group behind this extensive campaign Golden Falcon (or APT-C-34). The Chinese security vendor claimed the group was new, but when ZDNet reached out to Kaspersky, we were told Golden Falcon appears to be another name for DustSquad, a cyber-espionage entity that has been active since 2017.
The only report detailing its previous hacking operations dates back to 2018 when it was seen using spear-phishing emails that lead users to a malware-laced version of Telegram.
Just like the attacks documented by Qihoo this week, the 2018 attacks also focused on Kazakhstan but had used a different malware strain.
Qihoo’s new report is primarily based on data the Chinese company obtained after it gained access to one of Golden Falcon’s command and control (C&C) server, from where they retrieved operational data about the group’s activities.
Here, the Chinese firm said it found data retrieved from infected victims. Collected data involved primarily office documents, taken from hacked computers.
All the stolen information was arranged in per-city folders, with each city folder containing data on each infected host. Researchers said they found data from victims located in Kazakhstan 13 largest cities, and more.
The data was encrypted, but researchers said they were able to decrypt it. Inside, they also found evidence that Golden Falcon was also spying on foreign nationals in the country — with Qihoo naming Chinese international students and Chinese diplomats as targets.
Expensive hacking tools
Files on the C&C server revealed what types of hacking tools this group was using. Two tools stood out. The first was a version of RCS (Remote Control System), a surveillance kit sold by Italian vendor HackingTeam. The second was a backdoor trojan named Harpoon (Garpun in the Russian language) that appears to have been developed by the group itself.
In regards to its use of RCS, what stood out was that Golden Falcon was using a new version of RCS. The RCS version number is important because, in 2015, a hacker breached and then leaked all the HackingTeam’s internal files, including the source code for RCS.
At the time, the RCS version number was 9.6. According to Qihoo, the version number for the RCS instances they found in Golden Falcon’s possession was 10.3, a newer version, meaning the group most likely bought a newer version from its distributor.
But Golden Falcon was also in the possession of another potent tool. Qihoo says the group was using a unique backdoor that hasn’t been seen outside the group’s operations and was most likely their own creation.
The Chinese vendor said it obtained a copy of this tool’s manual. It is unclear if they found the manual on the group’s C&C server, or if they obtained it from another source. The manual, however, shows a well-developed tool with a large feature-set, on par with many of today’s top existing backdoor trojans.
- Steal clipboard data
- Take screenshot of the active window at predetermined intervals
- List the contents of a given directory
- Get Skype login name, contact list, and chat message history
- Get Skype and Google Hangouts contacts and voice recordings
- Record sound via the microphone, eavesdropping
- Copy a specified file from the target computer
- Automatically copy files from removable media
- Store all intercepted data in an encrypted data file, inside a specified directory
- Send stolen data to a specified FTP server
- Run a program or operating system command
- Download files from a given FTP into a specific directory
- Remotely reconfigure and update components
- Receive data files from a given FTP and automatically extract the files to a specified directory
Most of the features listed above are the norm for most high-level backdoor trojans, usually encountered in nation-state level cyber-espionage.
But Qihoo researchers also found additional files, such as contracts, supposedly signed by the group.
It is important to point out that cyber-espionage groups don’t leave contracts sitting around on C&C servers. It is unclear if these contracts were found on Golden Falcon’s C&C server, or were retrieved from other sources. Qihoo didn’t say.
One of these contracts appears to be for the procurement of a mobile surveillance toolkit known as Pegasus. This is a powerful mobile hacking tool, with Android and iOS versions, sold by NSO Group.
The contract suggests that Golden Eagle had, at least, shown interest in acquiring NSO’s Android and iOS surveillance tools. It is unclear if the contract was ever completed with a sale, as Qihoo didn’t find any evidence of NSO’s Pegasus beyond the contract.
Either way, Golden Eagle did have mobile hacking capabilities. This capability was provided via Android malware supplied by the HackingTeam.
Qihoo said the malware they analyzed included 17 modules with features ranging from audio eavesdropping to browser history tracking, and from stealing IM chat logs to tracking a victim’s geo-location.
Radio interception hardware
A second set of contracts showed that Golden Falcon had also acquired equipment from Yurion, a Moscow-based defense contractor that’s specialized in radio monitoring, eavesdropping, and other communications equipment.
Again, Qihoo only shared details about the contract’s existence, but could not say if the equipment was bought or used — as such capabilities go beyond the tools at the disposal of a regular security software company.
Tracking down members?
The Chinese cyber-security firm also said it tracked down several Golden Falcon members through details left in legal digital signatures, supposedly found inside the contracts they discovered.
Researchers said they tracked four Golden Falcon members and one organization.
Using data that was left uncensored in a screenshot shared by Qihoo, we were able to track one of the group’s members to a LinkedIn profile belonging to a Moscow area-based programmer that the Chinese firm described as “a technical engineer” for Golden Falcon.
No official attribution — but plenty of theories
Neither Qihoo nor Kaspersky, in its 2018 report, make any formal attribution for this group. The only detail the two shared was that this was a Russian-speaking APT (advanced persistent threat — a technical term used to describe advanced, nation-state backed hacking units).
During research for this article, ZDNet asked a few analysts for their opinions. The most common theories we heard were that this “looks” to be (1) a Russian APT, (2) a Kazakh intelligence agency spying on its citizens, (3) a Russian mercenary group doing on-demand spying for the Kazakh government — with the last two being the most common answer.
However, it should be noted that these arguments are subjective and not based on any actual substantial proof.
The use of HackingTeam surveillance software, and the inquiry into buying NSO Group mobile hacking capabilities does show that this could be, indeed, an authorized law enforcement agency. However, Qihoo also pointed out that some of the targets/victims of this hacking campaign were also Chinese government officials in north-west China — meaning that if this was a Kazakh law enforcement agency, then they seriously overstepped their jurisdiction.
The Qihoo Golden Falcon report is available here, in Chinese, and here, translated with Google Translate. The report contains additional technical information about the malware used in these attacks, information that we didn’t include in our coverage because it was too technical.
When Is a DevSecOps Vendor Not a DevSecOps Vendor?
DevOps’ general aim is to enable a more efficient process for producing software and technology solutions and bringing stakeholders together to speed up delivery. But we know from experience that this inherently creative, outcome-driven approach often forgets about one thing until too late in the process—security. Too often, security is brought into the timeline just before deployment, risking last minute headaches and major delays. The security team is pushed into being the Greek chorus of the process, “ruining everyone’s fun” by demanding changes and slowing things down.
But as we know, in the complex, multi-cloud and containerized environment we find ourselves in, security is becoming more important and challenging than ever. And the costs of security failure are not only measured in slower deployment, but in compliance breaches and reputational damage.
The term “DevSecOps” has been coined to characterize how security needs to be at the heart of the DevOps process. This is in part principle and part tools. As a principle, DevSecOps fits with the concept of “shifting left,” that is, ensuring that security is treated as early as possible in the development process. So far, so simple.
From a tooling perspective, however, things get more complicated, not least because the market has seen a number of platforms marketing themselves as DevSecOps. As we have been writing our Key Criteria report on the subject, we have learned that not all DevSecOps vendors are necessarily DevSecOps vendors. Specifically, we have learned to distinguish capabilities that directly enable the goals of DevSecOps from a process perspective, from those designed to support DevSecOps practices. We could define them as: “Those that do, and those that help.”
This is how to tell the two types of vendor apart and how to use them.
Vendors Enabling DevSecOps: “Tools That Do”
A number of tools work to facilitate the DevSecOps process -– let’s bite the bullet and call them DevSecOps tools. They help teams set out each stage of software development, bringing siloed teams together behind a unified vision that allows fast, high-quality development, with security considerations at its core. DevSecOps tools work across the development process, for example:
- Create: Help to set and implement policy
- Develop: Apply guidance to the process and aid its implementation
- Test: Facilitate and guide security testing procedures
- Deploy: Provide reports to assure confidence to deploy the application
The key element that sets these tool sets apart is the ability to automate and reduce friction within the development process. They will prompt action, stop a team from moving from one stage to another if the process has not adequately addressed security concerns, and guide the roadmap for the development from start to finish.
Supporting DevSecOps: “Tools That Help”
In this category we place those tools which aid the execution, and monitoring, of good DevSecOps principles. Security scanning and application/infrastructure hardening tools are a key element of these processes: Software composition analysis (SCA) forms a part of the development stage, static/dynamic application security testing (SAST/DAST) is integral to the test stage and runtime app protection (RASP) is a key to the Deploy stage.
Tools like this are a vital part of the security layer of security tooling, especially just before deployment – and they often come with APIs so they can be plugged into the CI/CD process. However, while these capabilities are very important to DevSecOps, they can be seen in more of a supporting role, rather than being DevSecOps tools per se.
DevSecOps-washing is not a good idea for the enterprise
While one might argue that security should never have been shifted right, DevSecOps exists to ensure that security best practices take place across the development lifecycle. A corollary exists to the idea of “tools that help,” namely that organizations implementing these tools are not “doing DevSecOps,” any more than vendors providing these tools are DevSecOps vendors.
The only way to “do” DevSecOps is to fully embrace security at a process management and governance level: This means assessing risk, defining policy, setting review gates, and disallowing progress for insecure deliverables. Organizations that embrace DevSecOps can get help from what we are calling DevSecOps tools, as well as from scanning and hardening tools that help support its goals.
At the end of the day, all security and governance boils down to risk: If you buy a scanning tool so you can check a box that says “DevSecOps,” you are potentially adding to your risk posture, rather than mitigating it. So, get your DevSecOps strategy fixed first, then consider how you can add automation, visibility, and control using “tools that do,” as well as benefit from “tools that help.”
High Performance Application Security Testing
This free 1-hour webinar from GigaOm Research. It is hosted by an expert in Application and API testing, and GigaOm analyst, Jake Dolezal. His presentation will focus on the results of high performance testing we completed against two security mechanisms: ModSecurity on NGINX and NGINX App Protect. Additionally, we tested the AWS Web Application Firewall (WAF) as a fully managed security offering.
While performance is important, it is only one criterion for a Web Application Firewall selection. The results of the report are revealing about these platforms. The methodology will be shown with clarity and transparency on how you might replicate these tests to mimic your own workloads and requirements.
Register now to join GigaOm and sponsor NGINX for this free expert webinar.
Digital Risk, Compliance, and Data Centricity
This report examines the current state of digital governance, risk, and compliance within enterprise companies—an area that has recently seen dramatic shifts in policy, strategy, and working practices. We reached out to enterprises across a variety of industries to gauge their efforts to combat these challenges.
“We have seen a rapid acceleration of our customers’ digital transformation due to the increased need to support work from anywhere. These changes in how people work have introduced new risk and the need to protect and govern data in different ways. A holistic approach to risk management is critical to address security and compliance properly across the environment. We are working closely with our customers and partners to meet these challenges in an era of rapid change.”
Alym Rayani, GM, Microsoft
The research, based on over 300 survey respondents in the US and Europe, and supported by interviews with leading consulting and services firms, shows:
- Digital transformation is the number one priority affecting organizations today, both despite and because of recent events. Alongside privacy and regulation, consumer needs and reputational risk are significant factors driving activity.
- The fast-moving regulatory landscape and continued, rapid data growth conspire to create significant risk and compliance challenges. External hacking and cloud-based data breaches are also seen as a source of risk.
- The journey to the cloud is one way organizations are accelerating the movement of unstructured data (e.g. documents, spreadsheets or email and chats) to cloud-based, centralized repositories/services. Risk is cloud-based because that is where the data will reside.
- Business leaders are implementing or planning to implement a data centralization and platform consolidation strategy in response to business challenges and compliance demands.
- Performance and usability are important evaluation factors when it comes to compliance solutions procurement decision making, especially in the context of enabling remote work.
- AI and predictive analytics are taking on a growing role, providing tools to classify and handle sensitive data—including personally identifiable information (PII)—properly.
In conclusion, we recommend implementing a data consolidation and centralization strategy in conjunction with any move to the cloud. We recommend that enterprises start with data security and privacy drivers, address both tactical and strategic goals, and use the cloud as a catalyst for change. We urge companies to take an ecosystem-based approach, and to select solutions that help keep up with the changing regulatory landscape. Finally, we consider users to be a central element of success. On this final point, the research reveals that attitudes toward remote work have changed — enterprises are ready and willing to trust staff that are working outside of the office, even as they address the risks that emerge.
Logitech Ergo M575 Wireless Trackball Mouse aims to be ergonomic and save space
Logitech has made computer peripherals as long as the company has been around. It’s particularly well known for its keyboards...
Watch Dogs Legion review: A meaningless mob, with mostly merry mayhem
Believe it or not, this humble construction worker is a key figure in the hacker resistance. What if you’re not...
Hyundai unveils its smallest EV based on the 45 concept car
It’s hard to forget the wedge-shaped body style of Hyundai’s 45 concept vehicle. First seen at the Frankfurt Motor Show...
mophie juice pack connect slides a wireless charger behind your phone
mophie has pretty much flooded the accessory market with an abundance of choices to keep smartphones from dying while away...
UK to ban carriers from selling network-locked phones next year
There was a time when it seemed that carrier-subsidized phones as going out of fashion. That hasn’t changed at all...
Social9 months ago
CrashPlan for Small Business Review
Gadgets2 years ago
A fictional Facebook Portal videochat with Mark Zuckerberg – TechCrunch
Mobile2 years ago
Memory raises $5M to bring AI to time tracking – TechCrunch
Social2 years ago
iPhone XS priciest yet in South Korea
Cars2 years ago
Some internet outages predicted for the coming month as ‘768k Day’ approaches
Cars2 years ago
What’s the best cloud storage for you?
Security2 years ago
Google latest cloud to be Australian government certified
Social2 years ago
Apple’s new iPad Pro aims to keep enterprise momentum