Chinese group behind cyberattacks on India identified
By MYBRANDBOOK
Security researchers have discovered a Chinese hacking group that has stolen confidential data by attacking government organisations in six countries, including India.
Government organisations in India, Brazil, Kazakhstan, Russia, Thailand and Turkey suffered damage as a result of the group’s attacks, said specialists from London-headquartered global security solutions provider Positive Technologies.
The Calypso APT (or Advanced Persistent Threat) group has been active since 2016, Engadget reported.
To get access to the victim’s internal network, the attackers hack the network perimeter and inject a special programme which gave them, the investigation by Positive Technologies found. The investigation revealed that the attackers moved along the network either by exploiting Remote Code Execution vulnerability (MS17-010) or by using stolen credentials.
“These attacks succeeded largely because most of the utilities the group uses to move inside the network are widely used by the specialists everywhere for network administration,” Denis Kuvshinov, Lead Specialist in Threat Analysis at Positive Technologies said in a statement.
“The group used publicly available utilities and exploit tools, such as SysInternals, Mimikatz; EternalBlue, and EternalRomance. Using these widely available tools, the attackers infected computers on the organisation’s LAN ( local area network) and stole confidential data,” Kuvshinov said.
According to the experts at Positive Technologies, organisations can prevent such attacks by using specialised systems for deep traffic analysis. These systems facilitate the detection of suspicious activity at the early stages of the attackers’ incursion into the LAN, and then would prevent the hackers from getting a foothold in the company infrastructure.
In addition, monitoring of security incidents, along with perimeter and web applications protection, can also help in detecting and preventing these attacks.
In one of the attacks the group used PlugX malware – traditionally used by many Chinese APT groups. They also used Byeby trojan, which was involved in the SongXY malware campaign in 2017.
Also, in some of the attacks the hackers accidentally disclosed their real IP addresses, which belonged to Chinese providers. The group has several successful hacks to its credit, but still makes mistakes allowing us to guess its origins, Positive Technologies said in a report.
“We keep monitoring the activities of Calypso closely and expect the group will attack again,” the report says.
InterGlobe’s Rahul Bhatia and C.P. Gurnani together announce
In a move that is set to transform the AI landscape, Rahul Bhatia, Group M...
Download masked Aadhaar to improve privacy
Download a masked Aadhaar from UIDAI to improve privacy. Select masking w...
Sterlite Technologies' Rs 145 crore claim against BSNL rejecte
An arbitrator has rejected broadband technology company Sterlite Technolog...
ID-REDACT® ensures full compliance with the DPDP Act for Indi
Data Safeguard India Pvt Ltd, a wholly-owned subsidiary of Data Safeguard ...
STERLITE TECHNOLOGIES LTD.
IBALL WORLDWIDE PVT. LTD.
HP INDIA SALES PVT. LTD.
VERSA NETWORKS INDIA PVT. LTD.
Technology Icons Of India 2023: Sunil Bharti Mittal
Sunil Bharti Mittal is the Founder and Chairman of Bharti Enterprises,...
Technology Icons Of India 2023: B.V.R. Subrahmanyam
B.V.R. Subrahmanyam belongs to Andhra Pradesh. He is a 1987-batch IAS ...
Technology Icons Of India 2023: Vijay Shekhar Sharma
Vijay Shekhar Sharma is an Indian technology entrepreneur and billiona...
GSTN aims to integrate indirect tax ecosystem on a shared IT infrastructure
Goods and Services Tax Network (GSTN) has built Indirect Taxation plat...
Leading company into fertilizers in the country
NFL is a dynamic organization committed to serve the farming community...
STPI encouraging software exports from India
Software Technology Parks of India (STPI) is an S&T organization under...
TECHNOBIND SOLUTIONS PVT. LTD.
TechnoBind’s business model is focused on identifying and partnering...
BEETEL TELETECH LTD.
: Beetel is one of the oldest and most reputed brands in the Industry,...
INFLOW TECHNOLOGIES PVT. LTD.
Inflow Technologies is a niche player in the IT Infrastructure Distrib...