New espionage campaign tied to RSA breach, GhostNet attacks
A cyber espionage campaign, now linked to attacks on the energy and oil sector in various countries and a military organization, was likely launched by the same attackers behind an RSA breach and the GhostNet spy network.
Recent targets in the Mirage campaign – which is named after the remote access trojan Mirage spread through spear phishing emails – include an energy company in Canada, a high-profile oil company in the Philippines and a military organization in Taiwan.
Researchers at Dell SecureWorks Counter Threat Unit discovered Mirage, which is usually embedded in executable files designed to look and behave like PDFs, and began tracking the cyber espionage campaign in April. Silas Cutler, a security researcher for SecureWorks CTU, said that Mirage wasn't particularly sophisticated, but that it was effective in that it usually reached mid- to senior-level executives – who are targeted by the spear phishing emails.
