Researchers believe the China-based cyber espionage group that carried out a months-long breach of The New York Times' network is responsible for a spate of recent attacks leveraging new variants of the trojans used to attack the newspaper.
Security firm FireEye revealed that the group, dubbed "APT12" and believed to be backed by China's People's Liberation Army, updated the code for the backdoors Aumlib and IXESHE (pronounced i-sushi) to strike more organizations in May and June, several months after the attacks on the Times.
FireEye researchers Ned Moran and Nart Villeneuve blogged about the findings on Monday and said that the trojans were used against an unnamed organization that focuses on international economic and financial policy, as well as entities in Taiwan.
In a Tuesday email, FireEye researcher Ned Moran told SCMagazine.com that the two trojans were updated to evade detection.
The new Aumlib iteration now encodes its command-and-control server communications. In addition, IXESHE – advanced malware known for stealing critical data from government and private entities in Germany, Taiwan and other countries – also displayed different network traffic patterns that could help it remain under the radar.
“The most notable difference is the network communications protocol,” Moran said. "The changes in the network communications protocol appear to be designed to defeat network signatures and allow the attackers to operate undetected. Most network signatures tuned to detect the old variants are unlikely to work on the new variants,” Moran explained.
SCMagazine.com reached out to security firm Mandiant, which has closely studied attacks out of China, to confirm the ties between the Times attacks and the ones that occurred in May and June, but a spokeswoman said the company didn't have enough details to verify the attacks were carried out by the same group.
In a Wednesday follow-up email to SCMagazine.com, Moran said FireEye believes they are the same assailants because they reused command-and-control infrastructure and malware code in the attacks.
