An innocuous posting appeared on a Houston-based technology company's internal website on a recent Friday afternoon.
A couple of workers saw it, and obeyed instructions to click on a Web link. The posting seemed trustworthy. It was on an employees-only message board. And the link referenced news about a favorite company charity.
By clicking on the link, the workers infected their PCs with a virus that shut down the company's antivirus defenses, says Don Jackson, director of Threat Intelligence at Atlanta-based SecureWorks, who investigated the break-in. As a rule, tech security firms help clients under non-disclosure agreements.
The virus swiftly located — and infected — some 300 other workstation PCs, silently copying the contents of each computer's MyDocuments folder. It transmitted the data across the Internet to a gang of thieves operating out of Turkey.
It was kind of like high-tech dumpster diving," Jackson says. "You get in, grab all the stuff you think might be important and sort through it later."
That Sept. 19 caper underscores an alarming shift in the teeming world of Internet crime. In the past year, cybercriminals have begun to infiltrate corporate tech systems as never before. Knowing that some governments and companies will pay handsomely for industrial secrets, data thieves are harvesting as much corporate data as they can, in anticipation of rising demand.
Criminal groups are beginning to refine business models for turning data raided from corporate networks into cold, hard cash. "As they get better at finding ways to sell the information they steal, we can expect this type of attack to become more common — and harder to detect," says Marcus Sachs, director of the SANS Internet Storm Center.
No comments:
Post a Comment