Chinese Hackers malware targeted RSA companies

A Chinese hacker gang whose malware targeted RSA in 2011 infiltrated more than 100 companies and organizations, and was so eager to steal data that it probed a major teleconference developer to find new ways to spy on corporations, according to researchers. The remote-access Trojan, or RAT, tagged as "Comfoo" is largely inactive, said a pair of veteran researchers from Dell SecureWorks, who presented their findings at last week's Black Hat security conference.
But their discoveries showed just how pervasively a dedicated group of attackers can infiltrate networks and walk away with secrets.
"We're not seeing it used to the extent it was before," said Joe Stewart, director of malware research at SecureWorks, in explaining why he and his college, Don Jackson, revealed their undercover campaign.
For more than 18 months, Stewart and Jackson, a senior security researcher with SecureWorks' Counter Threat Unit (CTU), secretly monitored some of the workings of Comfoo, which they believe was the work of a hacker crew they've named the Beijing Group. The gang is one of China's top-two hacker organizations.
To start, Stewart captured a sample of the malware used in the RSA attack, at the time attributed to Chinese hackers, then reverse-engineered the encryption that the malware used to mask instructions to and from the gang's command-and-control (C&C) servers.
Eventually, Stewart was able to spy on the hackers as they logged onto those C&C servers. As they did, Stewart snatched the victims' MAC addresses -- unique identifiers for network hardware -- their IP, or "Internet protocol" addresses, and finally, a tag the hackers used to label each data-stealing campaign.
SecureWorks was not able to see what data the attackers were stealing, but their passive monitoring reaped dividends.
"We've done similar ops like this before," said Stewart, "but with the custom stuff, you rarely get this kind of insight or this level of detail of the attacks and victims."