RSA's SecurID breach linked to China, researcher says
The breach of RSA, the security division of EMC, last spring in which sensitive information related to RSA SecurID tokens was stolen, can be traced back to an attack originating in China, a security researcher strongly believes based on a close look into malware associated with the RSA breach.
Joe Stewart, director of malware research for Dell SecureWorks, says his conclusion is based on his work on a project to classify 60 different families of custom malware that have been used in the type of cyber-espionage attack often referred to today as an '"advanced persistent threat (APT)." The definition of APT can vary, but to Stewart it means cyber-espionage activity targeted at government or industry.
Two malware components known to have been used in the RSA breach are based on a common hacker tool called "HTran" that can disguise the location of their command-and-control servers used to siphon off sensitive stolen data back to the attackers.
