Menu
Poseidon hacker group behind long-running extortion scheme

Poseidon hacker group behind long-running extortion scheme

After compromising a network, the group tries to blackmail its corporate victims

Kaspersky Lab has linked a single group to a long-known campaign of cyberattacks that appears to be aimed at extorting corporate victims.

The Poseidon Group may have been active since 2001, according to an analysis of malware samples. The group's tools have been designed to function on systems set to English and Portuguese.

Victims are usually sent spear-phishing emails and malware hidden inside office documents. Once on a network, the hackers explore its topology in order to eventually steal intellectual property and commercial information.

"Then the attacker looks for all administrator accounts on both the local machine and the network," Kaspersky wrote in a post on Tuesday. "This technique allows them to map network resources and make lateral movements inside the network, landing in the perfect machine to match the attacker’s interest."

But the most interesting facet of Poseidon is that it doesn't just steal data.

"The information exfiltrated is then leveraged by a company front to blackmail victim companies into contracting the Poseidon Group as a security firm," Kaspersky wrote.

Even if a company is blackmailed into using Poseidon's alleged services, the group tries to maintain its malware on the affected company's system.

Kaspersky didn't provide a lot of detail about the ruse, but said that at least 35 companies have been affected in industries such as banking, government, telecommunications, manufacturing and energy, besides media and public relations firms.

Poseidon's attacks have been noticed before but never linked back to just one group, Kaspersky said. This is likely because the group frequently changes its infrastructure, such as command and control servers. It also signs malware with a variety of digital certificates with the names of rogue companies, Kaspersky said.

"By carefully collecting all the evidence and then reconstructing the attacker’s timeline, we found that it was actually a single group operating since at least 2005, and possible earlier, and still active on the market," the company wrote.

Kaspersky said it has reached out to companies that appear to have been infected and shared indicators of compromise, or technical information that points to an attack.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments