This site uses cookies. By continuing to browse this site you are agreeing to our use of cookies. Find out more.X

Espionage group that planted malware at New York Times is back

Share this article:

Researchers believe the China-based cyber espionage group that carried out a month-long breach of The New York Times' network is responsible for a spate of recent attacks leveraging new variants of the Trojans used to attack the newspaper.

Security firm FireEye revealed that the group, dubbed 'APT12' and believed to be backed by China's People's Liberation Army, updated the code for the backdoors Aumlib and IXESHE (pronounced i-sushi) to strike more organisations in May and June, several months after the attacks on the Times.

FireEye researchers Ned Moran and Nart Villeneuve blogged about the findings on Monday and said that the Trojans were used against an unnamed organisation that focuses on international economic and financial policy, as well as entities in Taiwan.

In an email sent on Tuesday, FireEye researcher Ned Moran told SCMagazine.com that the two Trojans were updated to evade detection.

The new Aumlib iteration now encodes its command-and-control server communications. In addition, IXESHE – advanced malware known for stealing critical data from government and private entities in Germany, Taiwan and other countries – also displayed different network traffic patterns that could help it remain under the radar.

“The most notable difference is the network communications protocol,” Moran said. "The changes in the network communications protocol appear to be designed to defeat network signatures and allow the attackers to operate undetected. Most network signatures tuned to detect the old variants are unlikely to work on the new variants,” Moran explained.

SCMagazine.com reached out to security firm Mandiant, which has closely studied attacks out of China, to confirm the ties between the Times attacks and the ones that occurred in May and June, but a spokeswoman said the company did not have enough details to verify the attacks were carried out by the same group.

In a follow-up email sent to SCMagazine.com on Wednesday, Moran said FireEye believes they are the same assailants because they reused command-and-control infrastructure and malware code in the attacks.

Share this article:

SC webcasts on demand

This is how to secure data in the cloud


Exclusive video webcast & Q&A sponsored by Vormetric


As enterprises look to take advantage of the cloud, they need to understand the importance of safeguarding their confidential and sensitive data in cloud environments. With the appropriate security safeguards, such as fine-grained access policies, a move to the cloud is as, or more, secure than an on-premise data storage.


View the webcast here to find out more

More in News

Cyber security still a learning curve for most companies

Cyber security still a learning curve for most ...

Poor network visibility, outdated security tools, a skills shortage and a lack of control in the cloud are just some of the reasons companies are struggling with cyber-security, say two ...

WorldPay hacker sentenced to 11 years for role in £6 million scheme

WorldPay hacker sentenced to 11 years for role ...

An Estonian man, who helped hack payment processor RBS WorldPay in 2008, has now been sentenced to 11 years in prison for his involvement in the £5.9 (US$ 9.4 million) ...

'Sophisticated' Chinese hackers launched attacks against 43,000 computer systems

'Sophisticated' Chinese hackers launched attacks against 43,000 computer ...

A new report reveals that a Chinese cyber-espionage group is closely affiliated with government and carried out attacks against the likes of Fortune 500 companies and government agencies.