Dragonfly: Energy Companies Under Sabotage Threat Symantec Security Response

Size: px

Start display at page:

Download "Dragonfly: Energy Companies Under Sabotage Threat Symantec Security Response"

Louisa Williamson
10 years ago
Views:

1 Dragonfly: Energy Companies Under Sabotage Threat Symantec Security Response Dragonfly: Western Energy Companies Under Sabotage Threat 1

2 What is Dragonfly? Ongoing cyberespionage campaign Targeting the energy sector in Europe and US Stealing information Capable of sabotage Dragonfly: Western Energy Companies Under Sabotage Threat 2

3 Targets Electricity infrastructure Electricity generation Industrial equipment providers Petroleum pipeline operators Dragonfly: Western Energy Companies Under Sabotage Threat 3

4 Target Locations Dragonfly: Western Energy Companies Under Sabotage Threat 4

5 The Dragonfly group In operation since at least 2011 Initially targeted defense and aviation companies in the US and Canada Shifted focus to US and European energy firms in early 2013 Priorities appear to be: Persistent access to targets Information stealing Sabotage Has the hallmarks of state sponsored operation Appear to be operating in the UTC +4 time zone Dragonfly: Western Energy Companies Under Sabotage Threat 5

Persistent access to targets Information stealing Sabotage Has the hallmarks of state sponsored operation

6 Dragonfly employs three attack vectors Spam s Watering hole attacks Compromising third party software Dragonfly: Western Energy Companies Under Sabotage Threat 6

7 Spam campaign Generic spam s sent to senior employees and engineers Began in February 2013 and continued into June s bore one of two subject lines: The account or Settlement of delivery problem. disguised malware as PDF attachment Dragonfly: Western Energy Companies Under Sabotage Threat 7

subject lines: The account or Settlement of delivery problem.

8 Watering hole attacks Group compromised legitimate websites related to energy sector Began in May 2013 and continued into April 2014 Attacks redirected website visitors to other compromised legitimate websites hosting Lightsout Exploit Kit These sites dropped malware on to the victim s computer. Dragonfly: Western Energy Companies Under Sabotage Threat 8

other compromised legitimate websites hosting Lightsout Exploit Kit These sites dropped

9 Compromising third party software Three ICS equipment providers targeted Malware inserted into the software bundles they had made available for download on their websites Victims inadvertently downloaded Trojanized software when applying software updates By targeting suppliers, attackers found soft underbelly that provided a path into bigger companies Dragonfly: Western Energy Companies Under Sabotage Threat 9

downloaded Trojanized software when applying software updates By targeting suppliers, attackers found

10 Timeline of recent attacks June July 2013 Company A Compromised and software trojanized May 13 - Apr 14 Watering-hole Attack Multiple energy related web sites compromised redirecting users to LOEK 16 Apr, Apr, 2014 Company C compromised Software Trojanized Feb 13 Mar 13 Apr 13 May 13 Jun 13 Jul 13 Aug 13 Sep 13 Oct 13 Nov 13 Dec 13 Jan 14 Feb 14 Mar 14 Apr 14 May 14 Jun 14 Jul 14 Aug 14 1 January, August, 2014 February 11, June 19, 2013 Spam campaign September 1, 2013 DF group start using Hello EK (Lightsout v2) January 20, January 30, 2014 Company B compromised and software trojanized 250 unique downloads Dragonfly: Western Energy Companies Under Sabotage Threat 10

Feb 14 Mar 14 Apr 14 May 14 Jun 14 Jul 14 Aug 14 1 January, 2013 31 August, 2014 February 11, 2013 - June 19, 2013 Spam campaign September 1, 2013 DF group start using Hello EK

11 Tools: Backdoor.Oldrea Remote access tool (RAT) type malware Custom malware, either written by the group itself or created for it Favoured tool: used in majority of attacks Acts as back door for attackers allowing them to extract data and install further malware Also known as Havex Dragonfly: Western Energy Companies Under Sabotage Threat 11

group itself or created for it Favoured tool: used in majority of attacks Acts as

12 Tools: Trojan.Karagany Was available on the underground market. Source code leaked in 2010 Dragonfly appear to have modified it for its own use Capable of uploading stolen data, downloading new files and running executable files Can run plugins, for collecting passwords, taking screenshots, and cataloging documents on infected computers. Dragonfly: Western Energy Companies Under Sabotage Threat 12

uploading stolen data, downloading new files and running executable files Can run plugins, for

13 Protection Symantec customers are protected from malware variants mentioned in this report. Detections are made by Symantec products using antivirus, Insight and behavioral technologies such as SONAR Symantec customers are protected from any attack using the exploits mentioned in this report when using Symantec products containing network threat protection/ips technologies Details on Symantec s protection technologies can be found here: Dragonfly: Western Energy Companies Under Sabotage Threat 13

protected from any attack using the exploits mentioned in this report when using Symantec products containing network threat

14 Summary Dragonfly is an ongoing threat Currently targeting energy sector in Europe and US Other sectors not immune, may be used as stepping stone Attacker capabilities persistent access to networks Information stealing Sabotage Well resourced with a range of technical capabilities Likely to be state-sponsored Presentation Identifier Goes Here 14

persistent access to networks Information stealing Sabotage Well resourced with a

15 More Resources Blog Twitter Whitepapers s.jsp Dragonfly: Western Energy Companies Under Sabotage Threat 15

com/threatintel Whitepapers http://www.symantec.

16 Thank you! Copyright 2012 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. Dragonfly: Western Energy Companies Under Sabotage Threat 16

Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising.

AT&T Global Network Client for Windows Product Support Matrix January 29, 2015

AT&T Global Network Client for Windows Product Support Matrix January 29, 2015 Product Support Matrix Following is the Product Support Matrix for the AT&T Global Network Client. See the AT&T Global Network