Menu
Attack on US veterans website may have been aimed at military members

Attack on US veterans website may have been aimed at military members

FireEye has linked the latest attacks to two other malware campaigns, believed to come from China

A cyberattack against the Veteran of Foreign Wars website, believed to have been initiated in China, may have sought to spy on U.S. military members, security company FireEye said Thursday.

FireEye said the attack, which has now been fixed on VFW.org, exploited a zero-day flaw in the Internet Explorer 10 browser. The company discovered the attack, and the flaw in the browser, on Tuesday.

A zero-day vulnerability is one for which a software fix is not ready, one of the most dangerous categories of security flaws. Microsoft, which occasionally issues emergency fixes for such problems, has said it is investigating.

FireEye, which scans the Internet for new attacks, has found two other lesser-trafficked websites have been rigged in the same attack as VFW.org, said Darien Kindlund, manager of threat intelligence for FireEye, in a phone interview. The company is calling the campaign "Operation SnowMan."

The group behind the attacks is a "fairly sophisticated threat actor," Kindlund said, but it tends to lean on finding new zero-day vulnerabilities rather than changing other aspects of their operations, such as their command-and-control systems.

"Once this operation subsides, they'll probably restart again," he said. "It still seems they're achieving mission success based on the slight tweaks they've done to their attack methodology."

The attackers compromised the VFW's website and placed a hidden iframe on the site that delivered an exploit from the attacker's server, FireEye wrote in a blog post. If successful, the attack deposits a backdoor called "ZxShell," which can steal files from a user's computer.

The style of attack is known as a drive-by download, and victims would not have an indication they've been compromised, Kindlund said.

The hackers may have been aiming to compromise service members visiting the site, he said. The VFW has 1.4 million members, including 75,000 still on active duty, according to its website.

The timing of the attack, ahead of the national President's Day holiday on Monday, may have been intentional to try to maximize the exposure window, Kindlund said. The attack was active for about three days.

An analysis of the backdoor delivered to compromised computers showed that it contacts a website hosted on an IP address that has been linked to other hacking campaigns, "Operation DeputyDog" and "Operation Ephemeral Hydra," both suspected to originate in China, he said.

Those campaigns both used zero-day exploits to compromise targets. Operation Deputy Dog targeted organizations in Japan, according to FireEye.

Part of the attack code used on VFW.org incorporates a Flash object from Adobe's Flash program, a method similar to that used in the DeputyDog and Ephemeral Hydra attacks, FireEye said.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk


Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags intrusionsecuritydata breachFireEyeExploits / vulnerabilitiesmalwareVeterans of Foreign Wars

Featured

Slideshows

Kiwi channel comes together for another round of After Hours

Kiwi channel comes together for another round of After Hours

The channel came together for another round of After Hours, with a bumper crowd of distributors, vendors and partners descending on The Jefferson in Auckland. Photos by Maria Stefina.​

Kiwi channel comes together for another round of After Hours
Consegna comes to town with AWS cloud offerings launch in Auckland

Consegna comes to town with AWS cloud offerings launch in Auckland

Emerging start-up Consegna has officially launched its cloud offerings in the New Zealand market, through a kick-off event held at Seafarers Building in Auckland.​ Founded in June 2016, the Auckland-based business is backed by AWS and supported by a global team of cloud specialists, leveraging global managed services partnerships with Rackspace locally.

Consegna comes to town with AWS cloud offerings launch in Auckland
Veritas honours top performing trans-Tasman partners

Veritas honours top performing trans-Tasman partners

Veritas honoured its top performing partners across the channel in Australia and New Zealand, recognising innovation and excellence on both sides of the Tasman. Revealed under the Vivid lights in Sydney, Intalock claimed the coveted Partner of the Year 2017 (Pacific) award, with Data#3 acknowledged for 12 months of strong growth across the market. Meanwhile, Datacom took home the New Zealand honours, with Global Storage and Insentra winning service provider and consulting awards respectively. Dicker Data was recognised as the standout distributor of the year, while Hitachi Data Systems claimed the alliance partner award. Photos by Bob Seary.

Veritas honours top performing trans-Tasman partners
Show Comments