This site uses cookies. By continuing to browse this site you are agreeing to our use of cookies. Find out more.X

Espionage group that planted malware at New York Times is back

Share this article:

Researchers believe the China-based cyber espionage group that carried out a month-long breach of The New York Times' network is responsible for a spate of recent attacks leveraging new variants of the Trojans used to attack the newspaper.

Security firm FireEye revealed that the group, dubbed 'APT12' and believed to be backed by China's People's Liberation Army, updated the code for the backdoors Aumlib and IXESHE (pronounced i-sushi) to strike more organisations in May and June, several months after the attacks on the Times.

FireEye researchers Ned Moran and Nart Villeneuve blogged about the findings on Monday and said that the Trojans were used against an unnamed organisation that focuses on international economic and financial policy, as well as entities in Taiwan.

In an email sent on Tuesday, FireEye researcher Ned Moran told SCMagazine.com that the two Trojans were updated to evade detection.

The new Aumlib iteration now encodes its command-and-control server communications. In addition, IXESHE – advanced malware known for stealing critical data from government and private entities in Germany, Taiwan and other countries – also displayed different network traffic patterns that could help it remain under the radar.

“The most notable difference is the network communications protocol,” Moran said. "The changes in the network communications protocol appear to be designed to defeat network signatures and allow the attackers to operate undetected. Most network signatures tuned to detect the old variants are unlikely to work on the new variants,” Moran explained.

SCMagazine.com reached out to security firm Mandiant, which has closely studied attacks out of China, to confirm the ties between the Times attacks and the ones that occurred in May and June, but a spokeswoman said the company did not have enough details to verify the attacks were carried out by the same group.

In a follow-up email sent to SCMagazine.com on Wednesday, Moran said FireEye believes they are the same assailants because they reused command-and-control infrastructure and malware code in the attacks.

Share this article:

SC webcasts on demand

This is how to secure data in the cloud


Exclusive video webcast & Q&A sponsored by Vormetric


As enterprises look to take advantage of the cloud, they need to understand the importance of safeguarding their confidential and sensitive data in cloud environments. With the appropriate security safeguards, such as fine-grained access policies, a move to the cloud is as, or more, secure than an on-premise data storage.


View the webcast here to find out more

More in News

Rogue UK and US spies 'help safeguard Tor network'

Rogue UK and US spies 'help safeguard Tor ...

Extremists and paedophiles protected by 'white hat' hackers in GCHQ and NSA, says unconfirmed BBC report.

Cyber Security Challenge joins with GCHQ for security development programme

Cyber Security Challenge joins with GCHQ for security ...

The Cyber Security Challenge is linking with GCHQ to develop counter-espionage and cyber security skills for the real world.

China may be targeting medical firms for IP data

China may be targeting medical firms for IP ...

Very little companies can do to defend themselves against state-sponsored attacks, says Storm Guidance director Sarb Sembhi.