Menu
Poseidon hacker group behind long-running extortion scheme

Poseidon hacker group behind long-running extortion scheme

After compromising a network, the group tries to blackmail its corporate victims

Kaspersky Lab has linked a single group to a long-known campaign of cyberattacks that appears to be aimed at extorting corporate victims.

The Poseidon Group may have been active since 2001, according to an analysis of malware samples. The group's tools have been designed to function on systems set to English and Portuguese.

Victims are usually sent spear-phishing emails and malware hidden inside office documents. Once on a network, the hackers explore its topology in order to eventually steal intellectual property and commercial information.

"Then the attacker looks for all administrator accounts on both the local machine and the network," Kaspersky wrote in a post on Tuesday. "This technique allows them to map network resources and make lateral movements inside the network, landing in the perfect machine to match the attacker’s interest."

But the most interesting facet of Poseidon is that it doesn't just steal data.

"The information exfiltrated is then leveraged by a company front to blackmail victim companies into contracting the Poseidon Group as a security firm," Kaspersky wrote.

Even if a company is blackmailed into using Poseidon's alleged services, the group tries to maintain its malware on the affected company's system.

Kaspersky didn't provide a lot of detail about the ruse, but said that at least 35 companies have been affected in industries such as banking, government, telecommunications, manufacturing and energy, besides media and public relations firms.

Poseidon's attacks have been noticed before but never linked back to just one group, Kaspersky said. This is likely because the group frequently changes its infrastructure, such as command and control servers. It also signs malware with a variety of digital certificates with the names of rogue companies, Kaspersky said.

"By carefully collecting all the evidence and then reconstructing the attacker’s timeline, we found that it was actually a single group operating since at least 2005, and possible earlier, and still active on the market," the company wrote.

Kaspersky said it has reached out to companies that appear to have been infected and shared indicators of compromise, or technical information that points to an attack.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Events

Why experience is the new battleground for partners

Join us for an exclusive webinar, in association with Hewlett Packard Enterprise and Technology Services Industry Association (TSIA) and learn about the latest industry insights and how technology services continue to evolve to deliver differentiated value, and how partners can be successful in 2021 and beyond.

Featured

Slideshows

Channel kicks 2021 into gear as After Hours returns to Auckland

Channel kicks 2021 into gear as After Hours returns to Auckland

After Hours made a welcome return to the channel social calendar with a bumper crowd of partners, distributors and vendors descending on The Pantry at Park Hyatt in Auckland to kick-start 2021.

Channel kicks 2021 into gear as After Hours returns to Auckland
The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards

The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards

Hundreds of leaders from the New Zealand IT industry gathered at the Hilton in Auckland on 17 November to celebrate the finest female talent in the Kiwi channel and recognise the winners of the Reseller News Women in ICT Awards (WIICTA) 2020.

The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards
Leading female front runners honoured at the 2020 Reseller News Women in ICT Awards

Leading female front runners honoured at the 2020 Reseller News Women in ICT Awards

The leading female front runners of the New Zealand ICT industry joined together for the annual Reseller News Women in ICT Awards event at the Hilton in Auckland, during which hundreds of guests celebrated 13 outstanding individuals who won awards, chosen from more than 50 finalists representing over 30 organisations.

Leading female front runners honoured at the 2020 Reseller News Women in ICT Awards
Show Comments