www.eweek.com Open in urlscan Pro
23.37.42.150  Public Scan

Form analysis
3 forms found in the DOM

Name: cse-search-box — /googlecse

<form action="/googlecse" id="cse-search-box" name="cse-search-box" onsubmit="return checkSearchValue();">
  <input type="hidden" name="cx" value="partner-pub-8768004398756183:8606422690">
  <input type="hidden" name="cof" value="FORID:11">
  <input type="hidden" name="ie" value="ISO-8859-1">
  <input id="searchField" name="q" class="form-control search-query" type="text" value="" placeholder="Custom Search"
    style="background: url(&quot;https://www.google.com/cse/static/images/1x/googlelogo_lightgrey_46x16dp.png&quot;) left center no-repeat rgb(255, 255, 255); text-indent: 48px;">
  <input class="search-submit" type="submit" value="" alt="Search eWeek site">
  <script type="text/javascript" src="//www.google.com/coop/cse/brand?form=cse-search-box&amp;lang="></script><input name="siteurl" type="hidden" value="www.eweek.com/security/mcafee-night-dragon-cyber-attack-unsophisticated-but-effective"><input
    name="ref" type="hidden" value=""><input name="ss" type="hidden" value="">
</form>

Name: cse-search-box-footer — /googlecse

<form action="/googlecse" id="cse-search-box-footer" name="cse-search-box-footer" onsubmit="return checkSearchFooterValue();">
  <input type="hidden" name="cx" value="partner-pub-8768004398756183:8606422690">
  <input type="hidden" name="cof" value="FORID:11">
  <input type="hidden" name="ie" value="ISO-8859-1">
  <input id="searchFieldFooter" name="q" class="form-control search-query" type="text" value="" placeholder="Custom Search"
    style="background: url(&quot;https://www.google.com/cse/static/images/1x/googlelogo_lightgrey_46x16dp.png&quot;) left center no-repeat rgb(255, 255, 255); text-indent: 48px;">
  <input class="search-submit" type="submit" value="" alt="Search eWeek site">
  <script type="text/javascript" src="//www.google.com/coop/cse/brand?form=cse-search-box-footer&amp;lang="></script><input name="siteurl" type="hidden"
    value="www.eweek.com/security/mcafee-night-dragon-cyber-attack-unsophisticated-but-effective"><input name="ref" type="hidden" value=""><input name="ss" type="hidden" value="">
</form>

Name: newsletterSubscribForm — POST

<form id="newsletterSubscribForm" method="post" name="newsletterSubscribForm">
  <div class="newsletter-icon"></div>
  <div class="newsletter-header">
    <div class="newsletter-arrow floatL"></div>
    <div class="newsletter-header-text floatL">
      <div class="subscribe-text">Subscribe <span class="newsletter-text">to</span></div>
      <div class="floatL newsletter-text">Editor's Pick</div>
    </div>
  </div>
  <div id="nlsubscribeMessage" class="error"></div>
  <div class="newsletter-form" id="newsletter-form">
    <div class="floatL">
      <input type="text" id="nl_email" name="nlemail" class="nlemail" maxlength="255" placeholder="Enter Email Address">
    </div>
    <div class="floatL">
      <input type="button" name="btnSubscribe" id="nl_submit_button" value="GO >" onclick="newsletterGlobalSubmit('newsletterSubscribForm','nlsubscribeMessage', 'nlsubscribeMessage'); return false;">
    </div>
  </div>
  <!--   <div class="login-form center-text">
                                Or <span class="submit_button" onclick="showGFrame('login', 'full');return false;">Log in</span>
                            </div> -->
  <div class="newsletter-more">
    <a id="morenewsletters" data-placement="left" data-toggle="popover" data-container="body" type="button" data-html="true" data-original-title="" title="">Click for more newsletters</a>
  </div>
  <div class="myeweek_vspace"></div>
  <div id="listContent" class="hide orig_listContent">
    <ul class="list-group no_border nlcheckbox">
      <li class="list-group-item no_border nlcheckbox">
        <span class="custom-checkbox"><input type="checkbox" id="subscribe_1" name="nlNewsletterKey" value="9310"></span>
        <label for="subscribe_1">Editor's Pick</label>
      </li>
      <li class="list-group-item no_border nlcheckbox">
        <span class="custom-checkbox"><input type="checkbox" id="subscribe_3" name="nlNewsletterKey" value="8710"></span>
        <label for="subscribe_3">Cloud Computing Digest</label>
      </li>
      <li class="list-group-item no_border nlcheckbox">
        <span class="custom-checkbox"><input type="checkbox" id="subscribe_4" name="nlNewsletterKey" value="10710"></span>
        <label for="subscribe_4">Mobile and Wireless Update</label>
      </li>
      <li class="list-group-item no_border nlcheckbox">
        <span class="custom-checkbox"><input type="checkbox" id="subscribe_5" name="nlNewsletterKey" value="8810"></span>
        <label for="subscribe_5">Best of eWEEK</label>
      </li>
      <li class="list-group-item no_border nlcheckbox">
        <span class="custom-checkbox"><input type="checkbox" id="subscribe_7" name="nlNewsletterKey" value="8910"></span>
        <label for="subscribe_7">Careers Smart Moves</label>
      </li>
      <li class="list-group-item no_border nlcheckbox">
        <span class="custom-checkbox"><input type="checkbox" id="subscribe_8" name="nlNewsletterKey" value="9010"></span>
        <label for="subscribe_8">Enterprise Applications Update</label>
      </li>
      <li class="list-group-item no_border nlcheckbox">
        <span class="custom-checkbox"><input type="checkbox" id="subscribe_13" name="nlNewsletterKey" value="10410"></span>
        <label for="subscribe_13">Storage Report</label>
      </li>
      <li class="list-group-item no_border nlcheckbox">
        <span class="custom-checkbox"><input type="checkbox" id="subscribe_17" name="nlNewsletterKey" value="9810"></span>
        <label for="subscribe_17">Infrastructure Update</label>
      </li>
      <li class="list-group-item no_border nlcheckbox">
        <span class="custom-checkbox"><input type="checkbox" id="subscribe_18" name="nlNewsletterKey" value="9910"></span>
        <label for="subscribe_18">Linux &amp; Open Source Update</label>
      </li>
      <li class="list-group-item no_border nlcheckbox">
        <span class="custom-checkbox"><input type="checkbox" id="subscribe_20" name="nlNewsletterKey" value="10310"></span>
        <label for="subscribe_20">Securing the Enterprise</label>
      </li>
      <li class="list-group-item no_border nlcheckbox">
        <span class="custom-checkbox"><input type="checkbox" id="subscribe_22" name="nlNewsletterKey" value="10610"></span>
        <label for="subscribe_22">What's Hot Now</label>
      </li>
      <li class="list-group-item no_border nlcheckbox">
        <span class="custom-checkbox"><input type="checkbox" id="subscribe_23" name="nlNewsletterKey" value="9410"></span>
        <label for="subscribe_23">eWEEKend</label>
      </li>
    </ul>
  </div>
</form>

Text Content

Advertiser Disclosure
  
  
  
  
  


 * Big Data and Analytics
    * AT&T Cybersecurity vs. Splunk: SIEM Comparison
    * Signifyd: Product Overview and Insight
    * Five Technology Trends in 2020 that Will Affect Your...
    * Cisco Systems Uncovers Its 'Internet of the Future'...
    * NVIDIA Brings AI To Health Care While Protecting Patient...

 * Cloud
    * IT Science Case Study: Preparing Students for Connected...
    * Strategic News Service's Top 10 Predictions for 2020
    * Four Mistakes for CIOs to Avoid in 2020, or Any Other...
    * AT&T Cybersecurity vs. Splunk: SIEM Comparison
    * Win 7 Sunset Increases Ransomware Risk: 5 Tips to Secure...

 * Mobile
    * Four Mistakes for CIOs to Avoid in 2020, or Any Other...
    * Aruba Combines Several Components in New SD-Branch...
    * Why AMD Had Such an Impressive CES Showing
    * At CES 2020, Dell Shows New Premium Latitude Line and...
    * Product Review: OnePlus 7T Pro 5G McLaren Phone

 * Networking
    * Aruba Combines Several Components in New SD-Branch...
    * Five Technology Trends in 2020 that Will Affect Your...
    * Zscaler Now Offering Freemium IoT Monitoring Dashboard
    * NVIDIA’s Recommendation Engine: Game Changer For Retail?
    * Cisco Systems Uncovers Its 'Internet of the Future'...

 * Security
    * Strategic News Service's Top 10 Predictions for 2020
    * How Digicert CertCentral Reduces Angst of Certificate...
    * Aruba Combines Several Components in New SD-Branch...
    * AT&T Cybersecurity vs. Splunk: SIEM Comparison
    * Signifyd: Product Overview and Insight

 * Storage
    * How Digicert CertCentral Reduces Angst of Certificate...
    * At CES 2020, Dell Shows New Premium Latitude Line and...
    * Win 7 Sunset Increases Ransomware Risk: 5 Tips to Secure...
    * The Inextricable Link Between Data Security and End-of-Life...
    * Cobalt Iron: Product Overview and Insight

 * Applications
    * How Digicert CertCentral Reduces Angst of Certificate...
    * Aruba Combines Several Components in New SD-Branch...
    * AT&T Cybersecurity vs. Splunk: SIEM Comparison
    * Signifyd: Product Overview and Insight
    * Cisco Systems Uncovers Its 'Internet of the Future'...

 * Sponsored Content
 * All Articles
 * More
    * IT Management
    * Innovation
    * Small Business
    * Development
    * Database
    * Servers
    * Research
    * All Articles

Toggle navigation Toggle search
Advertiser Disclosure


 * Big Data and Analytics
 * Cloud
 * Mobile
 * Networking
 * Security
 * Storage
 * Applications
 * Sponsored Content
 * All Articles

Advertisement

Close X
 * Home
 * Security


MCAFEE: NIGHT DRAGON CYBER-ATTACK UNSOPHISTICATED BUT EFFECTIVE

By: Brian Prince | February 10, 2011



Researchers say "Night Dragon" was effective at targeting critical
infrastructure companies but was not very sophisticated in its methods.

It is no secret critical infrastructure companies are on the hit list of
cyber-attackers. The latest entry on the list today comes courtesy of McAfee,
whose researchers uncovered a campaign of coordinated, covert attacks targeting
oil, energy and petrochemical companies that stretches back to November 2009.

The attacks, which McAfee has collectively dubbed "Night Dragon" (PDF), are
believed to emanate from China and relied on a mix of spear-phishing, social
engineering, Windows bugs and remote administration tools (RATs) for
success--none of which are particularly advanced, researchers said.

"The attacks were not very sophisticated and did not use any zero-day exploits,"
said Dmitri Alperovitch, vice president of threat research at McAfee Labs. "They
were, however, very successful, and information that (has) been (exfiltrated)
has enormous potential value to competitors."

That information, he said, includes financial documents related to oil and gas
field exploration and bid negotiations, as well as operational details on oil
and gas field production supervisory control and data acquisition (SCADA)
systems.

FURTHER READING

 * #eWEEKchat Sept. 8: Confidential Computing and Next-Gen...
 * Russian Attempt to Attack Tesla a Stark Warning to...

The attacks - which are still ongoing - span the globe, and have touched
companies, individuals and executives in Kazakhstan, Taiwan, Greece and the
United States. Circumstantial evidence found by McAfee points to attackers based
in China. For example, McAfee said it identified an individual based in Heze
City who provided crucial command and control (C&C) infrastructure to the
attackers.

"The individual runs a company that, according to the company's advertisements,
provides 'Hosted Servers in the U.S. with no records kept' for as little as 68
RMB (US$10) per year for 100 MB of space," McAfee said in its report. "The
company's U.S.-based leased servers have been used to host the zwShell C&C
application that controlled machines across the victim companies."

"Beyond the curious use of the "zw.china" password that unlocks the operation of
the zwShell C&C Trojan, McAfee has determined that all of the identified data
exfiltration activity occurred from Beijing-based IP addresses and operated
inside the victim companies weekdays from 9:00 a.m. to 5:00 p.m. Beijing time,
which also suggests that the involved individuals were "company men" working on
a regular job, rather than freelance or unprofessional hackers," according to
the report. "In addition, the attackers employed hacking tools of Chinese origin
and that are prevalent on Chinese underground hacking forums. These included
Hookmsgina and WinlogonHack, tools that intercept Windows logon requests and
hijack usernames and passwords."

To deploy their hacking tools, the attackers looked to compromise perimeter
security through SQL injection attacks on extranet Web servers, targeted
spear-phishing attacks aimed at mobile workers' laptops and compromising
corporate VPN accounts.

"Once the initial system was compromised, the attackers compromised local
administrator accounts and Active Directory administrator (and administrative
users) accounts," according to McAfee. "The attackers often used common Windows
utilities, such as SysInternals tools (acquired by Microsoft in 2006) - and
other publicly available software...to establish "backdoors" through reverse
proxies and planted Trojans that allowed the attackers to bypass network and
host security policies and settings. Desktop antivirus and anti-spyware tools
were also disabled in some instances - a common technique of targeted attacks."

Using password racking and pass-the-hash tools, the attackers gained additional
usernames and passwords. In addition, they used RAT malware to connect to other
machines and swipe e-mail archives and documents belonging to executives.

"What's remarkable about the MO [modus operandi], is these are fairly standard
techniques from Network Breach 101," said Anup Ghosh, founder and chief
scientist of Invincea. "Unfortunately this looks like another successful
user-targeted attack through spear phishing from what appears to be nation-state
actors who make it their day job to go after critical U.S. industry assets."

McAfee CTO George Kurtz blogged that it was possible the attack actually
stretched back as far as four years.

"Well-coordinated, targeted attacks such as Night Dragon, orchestrated by a
growing group of malicious attackers committed to their targets, are rapidly on
the rise," he wrote. "These targets have now moved beyond the defense industrial
base, government and military computers to include global corporate and
commercial targets. More and more, these attacks focus not on using and abusing
machines within the organizations being compromised, but rather on the theft of
specific data and intellectual property."


SPONSORED CONTENT ON

Which ERP solution is right for your business?
By TechnologyAdvice

Enterprise resource planning (ERP) software isn’t just for multinational
corporations anymore.



 * Previous Story
 * Previous Mozilla Adds Do Not Track Feature to Firefox 4 Beta
 * 
 * Next Array Networks Rolls Out Application Delivery Controllers...
 * Next Story





Subscribe to
Editor's Pick


Click for more newsletters

 * Editor's Pick
 * Cloud Computing Digest
 * Mobile and Wireless Update
 * Best of eWEEK
 * Careers Smart Moves
 * Enterprise Applications Update
 * Storage Report
 * Infrastructure Update
 * Linux & Open Source Update
 * Securing the Enterprise
 * What's Hot Now
 * eWEEKend







EDITOR'S CHOICE


How RangeForce Brings Management, Measurement to Enterprise...
By: Frank Ohlhorst | September 08, 2020
 * 
 * 
 * 

 * How Intel Optane Helps Unify the Memory-Storage Pool
 * 
 * Why Dell’s New Global Channel Chief Has Such a Pivotal...
 * How IBM Is Bringing Confidential Computing into the...


RELATED VIDEO


How BlackBerry Has Become a Cyber-Security Player

eWEEK VIDEO: BlackBerry CTO Charles Eagan explains where his company's
cyber-security efforts...


Why McAfee Is Integrating AI Into Next Gen Security

eWEEK VIDEO: McAfee CTO Steve Grobman provides insight into why artificial
intelligence is...

View all








Contact Us | About eWeek | Sitemap

 * 
 * 
 * 
 * 
 * 

Property of TechnologyAdvice.
Terms of Service | Privacy Notice | Advertise | California - Do Not Sell My Info

Copyright 2020 TechnologyAdvice. All Rights Reserved

Advertiser Disclosure: Some of the products that appear on this site are from
companies from which TechnologyAdvice receives compensation. This compensation
may impact how and where products appear on this site including, for example,
the order in which they appear. TechnologyAdvice does not include all companies
or all types of products available in the marketplace.


We use cookies to personalize and enhance your experience on our site. Visit our
Privacy Policy to learn more or manage your personal preferences in our Cookie
Consent Tool. By using our site, you agree to our use of cookies.
Accept