This site uses cookies. By continuing to browse this site you are agreeing to our use of cookies. Find out more.X

Espionage group that planted malware at New York Times is back

Share this article:

Researchers believe the China-based cyber espionage group that carried out a month-long breach of The New York Times' network is responsible for a spate of recent attacks leveraging new variants of the Trojans used to attack the newspaper.

Security firm FireEye revealed that the group, dubbed 'APT12' and believed to be backed by China's People's Liberation Army, updated the code for the backdoors Aumlib and IXESHE (pronounced i-sushi) to strike more organisations in May and June, several months after the attacks on the Times.

FireEye researchers Ned Moran and Nart Villeneuve blogged about the findings on Monday and said that the Trojans were used against an unnamed organisation that focuses on international economic and financial policy, as well as entities in Taiwan.

In an email sent on Tuesday, FireEye researcher Ned Moran told SCMagazine.com that the two Trojans were updated to evade detection.

The new Aumlib iteration now encodes its command-and-control server communications. In addition, IXESHE – advanced malware known for stealing critical data from government and private entities in Germany, Taiwan and other countries – also displayed different network traffic patterns that could help it remain under the radar.

“The most notable difference is the network communications protocol,” Moran said. "The changes in the network communications protocol appear to be designed to defeat network signatures and allow the attackers to operate undetected. Most network signatures tuned to detect the old variants are unlikely to work on the new variants,” Moran explained.

SCMagazine.com reached out to security firm Mandiant, which has closely studied attacks out of China, to confirm the ties between the Times attacks and the ones that occurred in May and June, but a spokeswoman said the company did not have enough details to verify the attacks were carried out by the same group.

In a follow-up email sent to SCMagazine.com on Wednesday, Moran said FireEye believes they are the same assailants because they reused command-and-control infrastructure and malware code in the attacks.

Share this article:

SC webcasts on demand

This is how to secure data in the cloud


Exclusive video webcast & Q&A sponsored by Vormetric


As enterprises look to take advantage of the cloud, they need to understand the importance of safeguarding their confidential and sensitive data in cloud environments. With the appropriate security safeguards, such as fine-grained access policies, a move to the cloud is as, or more, secure than an on-premise data storage.


View the webcast here to find out more

More in News

Chinese hackers steal confidential documents on Israeli missile defence system

Chinese hackers steal confidential documents on Israeli missile ...

Chinese hackers comprised the computer systems of three Israeli defence contractors between 10 October 2011 and 13 August 2012 in order to steal hundreds on confidential documents on Israel's Iron ...

Security researcher finds exploitable flaws in 14 antivirus engines

Security researcher finds exploitable flaws in 14 antivirus ...

Joxean Koret, a security researcher at Singapore-based consultancy COSEINC, has found exploitable local and remote flaws in 14 of the 17 major antivirus (AV) engines used by most major AV ...

Russian government promises £60k bounty to Tor hackers

Russian government promises £60k bounty to Tor hackers

The Russian Ministry of Internal Affairs (MVD) is offering a 3.9 million ruble (approximately £64,600) reward to anyone who can find a way of identifying and tracking users of the ...