Hackers bent on espionage have infiltrated a large oil company in the Philippines, an energy biz in Canada and a military organisation in Taiwan among others, claim researchers.
The crooks also targeted other as yet unidentified businesses in Brazil, Israel, Egypt and Nigeria, according to the preliminary results of a probe by Dell SecureWorks. The researchers have been tracking the hackers' so-called Mirage campaign for about five months since April.
Secureworks reckons the group behind these latest attempts to obtain company secrets are the same miscreants who launched attacks against a Vietnamese petroleum firm and others in February in the so-called Sin Digoo affair. Email addresses linked to command servers associated with the Mirage campaign also emerged in the Sin Digoo op.
"This indicates that either the actors behind both the Sin Digoo Affair and Mirage APT [Advanced Persistent Threat] campaigns are the same person, or they are working within the same hacker group," the Dell SecureWorks team concluded in a report.
One of the people behind the Sin Digoo campaign previously ran a blackhat search engine optimisation business, which uses shady techniques to boost clients' websites up search rankings. And the malware used to infect corporate machines in the Mirage espionage disguises its connections to the hackers' server as harmless Google search queries. It pulls off this trick by crafting HTTP requests that look like typical lookup requests to Google's search engine frontend. Targeted emails containing booby-trapped attachments are used to push inject the Mirage Trojan onto Microsoft Windows PCs.
Victims are simply tricked into executing the files, at which point the malicious software installs itself and phones home with the specifications of the infected computer. It is not immediately clear exactly what kind of data is stolen by the spying software. Some variants of the worm include a line from The Matrix: "Neo, welcome to the desert of the real." Another variant includes a lyric from the REM song It's the end of the world as we know it.
The IP addresses of the systems used by hackers to remotely control Mirage-infected machines belong to the China Beijing Province Network (AS4808), as did three of the IP addresses used in the Sin Digoo campaign. "AS4808 is known for many other connections to malware and is considered by some to be a hotbed of espionage C2s [command and control servers]," SecureWorks concludes.
More details on the espionage campaign can be found on the SecureWorks website. ®