This site uses cookies. By continuing to browse this site you are agreeing to our use of cookies. Find out more.X

Espionage group that planted malware at New York Times is back

Share this article:

Researchers believe the China-based cyber espionage group that carried out a month-long breach of The New York Times' network is responsible for a spate of recent attacks leveraging new variants of the Trojans used to attack the newspaper.

Security firm FireEye revealed that the group, dubbed 'APT12' and believed to be backed by China's People's Liberation Army, updated the code for the backdoors Aumlib and IXESHE (pronounced i-sushi) to strike more organisations in May and June, several months after the attacks on the Times.

FireEye researchers Ned Moran and Nart Villeneuve blogged about the findings on Monday and said that the Trojans were used against an unnamed organisation that focuses on international economic and financial policy, as well as entities in Taiwan.

In an email sent on Tuesday, FireEye researcher Ned Moran told SCMagazine.com that the two Trojans were updated to evade detection.

The new Aumlib iteration now encodes its command-and-control server communications. In addition, IXESHE – advanced malware known for stealing critical data from government and private entities in Germany, Taiwan and other countries – also displayed different network traffic patterns that could help it remain under the radar.

“The most notable difference is the network communications protocol,” Moran said. "The changes in the network communications protocol appear to be designed to defeat network signatures and allow the attackers to operate undetected. Most network signatures tuned to detect the old variants are unlikely to work on the new variants,” Moran explained.

SCMagazine.com reached out to security firm Mandiant, which has closely studied attacks out of China, to confirm the ties between the Times attacks and the ones that occurred in May and June, but a spokeswoman said the company did not have enough details to verify the attacks were carried out by the same group.

In a follow-up email sent to SCMagazine.com on Wednesday, Moran said FireEye believes they are the same assailants because they reused command-and-control infrastructure and malware code in the attacks.

Share this article:

SC webcasts on demand

This is how to secure data in the cloud


Exclusive video webcast & Q&A sponsored by Vormetric


As enterprises look to take advantage of the cloud, they need to understand the importance of safeguarding their confidential and sensitive data in cloud environments. With the appropriate security safeguards, such as fine-grained access policies, a move to the cloud is as, or more, secure than an on-premise data storage.


View the webcast here to find out more

More in News

VC cyber security funding tops £850 million

VC cyber security funding tops £850 million

A new study from US-based research firm CBI Insights reveals that corporate cyber security investments have risen five-fold since 2009, with 30 percent growth in the last year alone.

Russian/Chinese cyber-security pact raises concerns

Russian/Chinese cyber-security pact raises concerns

News that Russia and China are set to sign a cyber-security treaty next month have left Western cyber experts unsure whether it is a threat or a promising development.

UK police arrest trio over £1.6 million cyber theft from cash machines

UK police arrest trio over £1.6 million cyber ...

London Police have arrested three suspected members of an Eastern European cyber-crime gang who installed malware on more than 50 bank ATM machines across the UK to steal £1.6 million.