Symantec Corp, a digital security company, says it has identified a sustained cyber spying campaign, likely state-sponsored, against Indian and Pakistani entities involved in regional security issues.

In a threat intelligence report that was sent to clients in July, Symantec said the online espionage effort dated back to October 2016.

The campaign appeared to be the work of several groups, but tactics and techniques used suggest that the groups were operating with &quot;similar goals or under the same sponsor&quot;,&nbsp;probably a nation state, according to the threat report, which was reviewed by Reuters. It did not name a state.

The detailed report on the cyber spying comes at a time of heightened tensions in the region.

India&#39;s military has raised operational readiness along its border with China following a face-off in Bhutan near their disputed frontier, while Indo-Pakistan tensions are also simmering over the disputed Kashmir region.

A spokesman for Symantec said the company does not comment publicly on the malware analysis, investigations and incident response services it provides clients.

Symantec did not identify the likely sponsor of the attack. But it said that governments and militaries with operations in South Asia and interests in regional security issues would likely be at risk from the malware. The malware utilizes the so-called &ldquo;Ehdoor&rdquo; back door to access files on computers.

&ldquo;There was a similar campaign that targeted Qatar using programs called Spynote and Revokery,&rdquo; said a security expert, who requested anonymity. &ldquo;They were back doors just like Ehdoor, which is a targeted effort for South Asia.&rdquo;

To install the malware, Symantec found, the attackers used decoy documents related to security issues in South Asia. The documents included reports from Reuters, Zee News, and the Hindu, and were related to military issues, Kashmir, and an Indian secessionist movement.

The malware allows spies to upload and download files, carry out processes, log keystrokes, identify the target&rsquo;s location, steal personal data, and take screenshots, Symantec said, adding that the malware was also being used to target Android devices.

In response to frequent cyber-security incidents, India in February established a center to help companies and individuals detect and remove malware. The center is operated by the Indian Computer Emergency Response Team (CERT-In).

Gulshan Rai, the director general of CERT-In, declined to comment specifically on the attack cited in the Symantec report, but added: &ldquo;We took prompt action when we discovered a back door last October after a group in Singapore alerted us.&rdquo; He did not elaborate.

Symantec&#39;s&nbsp;report said an investigation into the back door showed that it was constantly being modified to provide &quot;additional capabilities&quot;&nbsp;for spying operations.

A senior official with Pakistan&rsquo;s Federal Investigation Agency said it had not received any reports of malware incidents from government information technology departments. He asked not to be named due to the sensitivity of the matter.

A spokesman for FireEye, another cybersecurity company, said that based on an initial review of the malware, it had concluded that an internet protocol address in Pakistan had submitted the malware to a testing service. The spokesman requested anonymity, citing company policy.

Another FireEye official said the attack reported by Symantec was not surprising.

&quot;South Asia is a hotbed of geopolitical tensions, and wherever we find heightened tensions we expect to see elevated levels of cyber espionage activity,&quot; said Tim Wellsmore, FireEye&#39;s director of threat intelligence for the Asia Pacific region.

The Symantec report said the &#39;Ehdoor&#39; back door was initially used in late 2016 to target government, military and military-affiliated targets in the Middle East and elsewhere.

Governments and militaries with operations in South Asia and interests in regional security issues would likely be at risk from the malware, Symantec Corp said

Symantec Corp, a digital security company, says it has identified a sustained cyber spying campaign, likely state-sponsored, against Indian and Pakistani entities involved in regional security issues. In a threat intelligence report that was sent to clients in July, Symantec said the online espionage effort dated back to October 2016. The campaign appeared to be the work of several groups, but tactics and techniques used suggest that the groups were operating with "similar goals or under the same sponsor", probably a nation state, according to the threat report, which was reviewed by Reuters. It did not name a state. The detailed report on the cyber spying comes at a time of heightened tensions in the region. India's military has raised operational readiness along its border with China following a face-off in Bhutan near their disputed frontier, while Indo-Pakistan tensions are also simmering over the disputed Kashmir region. A spokesman for Symantec said the company does not comment publicly on the malware analysis, investigations and incident response services it provides clients. Symantec did not identify the likely sponsor of the attack. But it said that governments and militaries with operations in South Asia and interests in regional security issues would likely be at risk from the malware. The malware utilizes the so-called “Ehdoor” back door to access files on computers. “There was a similar campaign that targeted Qatar using programs called Spynote and Revokery,” said a security expert, who requested anonymity. “They were back doors just like Ehdoor, which is a targeted effort for South Asia.” To install the malware, Symantec found, the attackers used decoy documents related to security issues in South Asia. The documents included reports from Reuters, Zee News, and the Hindu, and were related to military issues, Kashmir, and an Indian secessionist movement. The malware allows spies to upload and download files, carry out processes, log keystrokes, identify the target’s location, steal personal data, and take screenshots, Symantec said, adding that the malware was also being used to target Android devices. In response to frequent cyber-security incidents, India in February established a center to help companies and individuals detect and remove malware. The center is operated by the Indian Computer Emergency Response Team (CERT-In). Gulshan Rai, the director general of CERT-In, declined to comment specifically on the attack cited in the Symantec report, but added: “We took prompt action when we discovered a back door last October after a group in Singapore alerted us.” He did not elaborate. Symantec's report said an investigation into the back door showed that it was constantly being modified to provide "additional capabilities" for spying operations. A senior official with Pakistan’s Federal Investigation Agency said it had not received any reports of malware incidents from government information technology departments. He asked not to be named due to the sensitivity of the matter. A spokesman for FireEye, another cybersecurity company, said that based on an initial review of the malware, it had concluded that an internet protocol address in Pakistan had submitted the malware to a testing service. The spokesman requested anonymity, citing company policy. Another FireEye official said the attack reported by Symantec was not surprising. "South Asia is a hotbed of geopolitical tensions, and wherever we find heightened tensions we expect to see elevated levels of cyber espionage activity," said Tim Wellsmore, FireEye's director of threat intelligence for the Asia Pacific region. The Symantec report said the 'Ehdoor' back door was initially used in late 2016 to target government, military and military-affiliated targets in the Middle East and elsewhere.

India, Pakistan hit by state-sponsored spy malware: Cyber security firm

Symantec is acquiring Israeli cyber security startup Fireglass, the company said, in a small deal designed to boost its products that protect corporate email and web browsing from threats.

Symantec is paying an undisclosed sum for the Tel Aviv-based company of about 40 employees. Fireglass specializes in an area of security called &quot;browser isolation,&quot; a technology that creates virtual websites allowing users to browse any content without having viruses touch their network.

&quot;Browser isolation&quot; is an area that Symantec had been looking to enter for some time, Chief Executive Greg Brown said in an interview. He cited a Gartner report that projected that 50 per cent of enterprises would adopt browser isolation by 2021.

Healthcare companies, financial institutions, government, and telecommunications firms have been early adopters of the technology, he said.

&quot;While it&#39;s what I would call a &#39;tuck-in&#39; acquisition, it will be very valuable to us as we bring it to our customers,&quot; Brown said.

Symantec has been one of the most serial acquirers in security companies in recent years, gobbling up Lifelock for $2.3 billion earlier this year and Blue Coat for $4.65 billion in 2015.

The deal will also increase the company&#39;s footprint in Israel, a hotbed for cyber security, where Brown said Symantec has been looking to expand. Israel, which has more than 400 cybersecurity startups, attracts about 20 per cent of private global cyber investment.

Large US technology companies often go &quot;shopping&quot; in Israel when they are looking for acquisitions and engineering talent. Last month, Microsoft agreed to acquire Hexadite, a US -Israeli provider of technology to automate responses to cyber attacks for an undisclosed sum.

The deal is expected to close in the third quarter of the calendar year.

Fireglass, founded in 2014 by a former Check Point Software Technologies executive, was backed by investors such as Lightspeed Venture Partners and Norwest Venture Partners. It had raised $20 million in early 2016 and competes with Menlo Security.

The startup will boost its products that protect corporate email and web browsing from threats

Symantec is acquiring Israeli cyber security startup Fireglass, the company said, in a small deal designed to boost its products that protect corporate email and web browsing from threats. Symantec is paying an undisclosed sum for the Tel Aviv-based company of about 40 employees. Fireglass specializes in an area of security called "browser isolation," a technology that creates virtual websites allowing users to browse any content without having viruses touch their network. "Browser isolation" is an area that Symantec had been looking to enter for some time, Chief Executive Greg Brown said in an interview. He cited a Gartner report that projected that 50 per cent of enterprises would adopt browser isolation by 2021. Healthcare companies, financial institutions, government, and telecommunications firms have been early adopters of the technology, he said. "While it's what I would call a 'tuck-in' acquisition, it will be very valuable to us as we bring it to our customers," Brown said. Symantec has been one of the most serial acquirers in security companies in recent years, gobbling up Lifelock for $2.3 billion earlier this year and Blue Coat for $4.65 billion in 2015. The deal will also increase the company's footprint in Israel, a hotbed for cyber security, where Brown said Symantec has been looking to expand. Israel, which has more than 400 cybersecurity startups, attracts about 20 per cent of private global cyber investment. Large US technology companies often go "shopping" in Israel when they are looking for acquisitions and engineering talent. Last month, Microsoft agreed to acquire Hexadite, a US -Israeli provider of technology to automate responses to cyber attacks for an undisclosed sum. The deal is expected to close in the third quarter of the calendar year. Fireglass, founded in 2014 by a former Check Point Software Technologies executive, was backed by investors such as Lightspeed Venture Partners and Norwest Venture Partners. It had raised $20 million in early 2016 and competes with Menlo Security.

Symantec to buy Israeli cybersecurity firm Fireglass

Cyber security firm Symantec said it was &quot;highly likely&quot; a hacking group affiliated with North Korea was behind the WannaCry cyber attack this month that infected more than 300,000 computers worldwide and disrupted hospitals, banks and schools across the globe.

Symantec researchers said they had found multiple instances of code that had been used both in the North Korea-linked group&#39;s previous activity and in early versions of WannaCry.

In addition, the same Internet connection was used to install an early version of WannaCry on two computers and to communicate with a tool that destroyed files at Sony Pictures Entertainment. The US&nbsp;government and private companies have accused North Korea in the 2014 Sony attack.

North Korea has routinely denied any such role. On Monday, it called earlier reports that it might have been behind the WannaCry attack &quot;a dirty and despicable smear campaign.&quot;

Lazarus is the name many security companies have given to the hacking group behind the Sony attack and others. By custom, Symantec does not attribute cyber campaigns directly to governments, but its researchers did not dispute the common belief that Lazarus works for North Korea.

In a blog post, Symantec listed numerous links between Lazarus and software the group had left behind after launching an earlier, less virulent, version of the malware in February. One was a variant of software used to wipe disks during the Sony Pictures attack, while another tool used the same internet addresses as two other pieces of malware linked to Lazarus.

At the same time, flaws in the WannaCry code, its wide spread, and its demands for payment in the electronic bitcoin before files are decrypted suggest that the hackers were not working for North Korean government objectives in this case, said Vikram Thakur, Symantec&#39;s security response technical director.

&quot;Our confidence is very high that this is the work of people associated with the Lazarus Group, because they had to have source code access,&quot; Thakur said in an interview.

But he added: &quot;We don&#39;t think that this is an operation run by a nation-state.&quot;

With WannaCry, Thakur said, Lazarus Group members could have been moonlighting to make extra money, or they could have left government service, or they could have been contractors without direct obligations to serve only the government.

The most effective version of WannaCry spread by using a flaw in Microsoft&#39;s Windows and a program that took advantage of it that had been used by the US&nbsp;National Security Agency, officials said privately.

That program was among a batch leaked or stolen and then dumped online by a group calling itself The Shadow Brokers, who some in US&nbsp;intelligence believe to be affiliated with Russia.

Analysts have been weighing in with various theories on the identity of those behind WannaCry, and some early evidence had pointed to North Korea. The Shadow Brokers endorsed that theory, perhaps to take heat off their own government backers for the disaster.

Cybersecurity company Kaspersky has said it had found several similarities between the WannaCry malware from the earlier attack and those used by Lazarus. But in an interview last week, its Asia research director, Vitaly Kamluk, said it was not conclusive evidence. &quot;It&#39;s unusual,&quot; he said.

Beau Woods, deputy director of the Cyber Statecraft Initiative at the Atlantic Council, said that the Korean language used in some versions of the WannaCry ransom note was not that of a native speaker, making a Lazarus connection unlikely.

But Thakur said that some hackers deliberately obfuscate their language to make tracing them harder. It is also possible that the writer in question was a contractor in another country, he said.

Thakur said a less likely scenario is that Lazarus&#39; main aim was to create chaos by distributing WannaCry.

If the hackers&#39; main objective was to earn money on the side, that would suggest an undisciplined hacking operation run by North Korea, one that could be exploited and weakened by the country&#39;s many foes.

&quot;The intelligence community will probably take away from this that there is a possibility of splinters in the Lazarus Group, or members who are interested in filling their own pockets, and that could help,&quot; Thakur said.

Lazarus has also been linked to attacks on banks using their SWIFT messaging network. Last year, hackers stole $81 million from Bangladesh&#39;s central bank. Symantec said malware used in that attack was linked to Lazarus.

(Reuters)

Symantec researchers have found multiple instances of code used both in the North Korea-linked group's previous activity and in early versions of WannaCry

Cyber security firm Symantec said it was "highly likely" a hacking group affiliated with North Korea was behind the WannaCry cyber attack this month that infected more than 300,000 computers worldwide and disrupted hospitals, banks and schools across the globe. Symantec researchers said they had found multiple instances of code that had been used both in the North Korea-linked group's previous activity and in early versions of WannaCry. In addition, the same Internet connection was used to install an early version of WannaCry on two computers and to communicate with a tool that destroyed files at Sony Pictures Entertainment. The US government and private companies have accused North Korea in the 2014 Sony attack. North Korea has routinely denied any such role. On Monday, it called earlier reports that it might have been behind the WannaCry attack "a dirty and despicable smear campaign." Lazarus is the name many security companies have given to the hacking group behind the Sony attack and others. By custom, Symantec does not attribute cyber campaigns directly to governments, but its researchers did not dispute the common belief that Lazarus works for North Korea. In a blog post, Symantec listed numerous links between Lazarus and software the group had left behind after launching an earlier, less virulent, version of the malware in February. One was a variant of software used to wipe disks during the Sony Pictures attack, while another tool used the same internet addresses as two other pieces of malware linked to Lazarus. At the same time, flaws in the WannaCry code, its wide spread, and its demands for payment in the electronic bitcoin before files are decrypted suggest that the hackers were not working for North Korean government objectives in this case, said Vikram Thakur, Symantec's security response technical director. "Our confidence is very high that this is the work of people associated with the Lazarus Group, because they had to have source code access," Thakur said in an interview. But he added: "We don't think that this is an operation run by a nation-state." With WannaCry, Thakur said, Lazarus Group members could have been moonlighting to make extra money, or they could have left government service, or they could have been contractors without direct obligations to serve only the government. The most effective version of WannaCry spread by using a flaw in Microsoft's Windows and a program that took advantage of it that had been used by the US National Security Agency, officials said privately. That program was among a batch leaked or stolen and then dumped online by a group calling itself The Shadow Brokers, who some in US intelligence believe to be affiliated with Russia. Analysts have been weighing in with various theories on the identity of those behind WannaCry, and some early evidence had pointed to North Korea. The Shadow Brokers endorsed that theory, perhaps to take heat off their own government backers for the disaster. Cybersecurity company Kaspersky has said it had found several similarities between the WannaCry malware from the earlier attack and those used by Lazarus. But in an interview last week, its Asia research director, Vitaly Kamluk, said it was not conclusive evidence. "It's unusual," he said. Beau Woods, deputy director of the Cyber Statecraft Initiative at the Atlantic Council, said that the Korean language used in some versions of the WannaCry ransom note was not that of a native speaker, making a Lazarus connection unlikely. But Thakur said that some hackers deliberately obfuscate their language to make tracing them harder. It is also possible that the writer in question was a contractor in another country, he said. Thakur said a less likely scenario is that Lazarus' main aim was to create chaos by distributing WannaCry. If the hackers' main objective was to earn money on the side, that would suggest an undisciplined hacking operation run by North Korea, one that could be exploited and weakened by the country's many foes. "The intelligence community will probably take away from this that there is a possibility of splinters in the Lazarus Group, or members who are interested in filling their own pockets, and that could help," Thakur said. Lazarus has also been linked to attacks on banks using their SWIFT messaging network. Last year, hackers stole $81 million from Bangladesh's central bank. Symantec said malware used in that attack was linked to Lazarus. (Reuters)

Symantec says 'highly likely' North Korea group behind ransomware attacks

symantec

Symantec, News on Symantec, stories on Symantec, articles on Symantec, Symantec stories at Wion, Symantec news, Symantec latest news