Security Experts:

Connect with us

Hi, what are you looking for?



Cyber War Tracking of Hackers Requires Diverse Approach: FireEye

In kinetic warfare, tracing the path of an enemy missile is not difficult. In the domain of cyberspace however, attributing an attack to a particular source can be problematic.

In kinetic warfare, tracing the path of an enemy missile is not difficult. In the domain of cyberspace however, attributing an attack to a particular source can be problematic.

Still, there are common threads that can link targeted attacks and be used to help identify what part of the world they come from, according to a new report from FireEye.

“To help with attribution, techies must follow the news,” advised Kenneth Geers, senior global threat analyst with FireEye. “Wherever there is traditional conflict, there is cyber conflict. For example, with looming Western intervention in Syria, it was only logical that the “hacktivist” Syrian Electronic Army would escalate its attacks and that a key battleground for public opinion would be U.S. media sites.”

When it comes to nation states, computer forensics, reverse engineering and log file analysis are just one part of cyber attack attribution, said Geers.

“Governments have human and signals intelligence, “hack backs”, law enforcement, diplomacy, economic pressure, political incentives, and much more. It is easy to forget how big the national toolbox really is,” he said.

Attackers work from a toolbox of their own, and there are some common items inside it. According to FireEye, there may be clues contained in the tools, tactics and procedures used by attackers that can be used to determine who is behind an attack. For example, Russian cybercriminals typically include a heavier reliance on human intelligence sources as well as command and control that uses custom embedded encoding.

“TTP [tools, tactics and procedures] often includes the delivery of weaponized email attachments, though Russian cybercriminals appear to be adept at changing their attack patterns, exploits, and data exfiltration methods to evade detection,” according to the report. “In fact, one telltale aspect of Russian hackers seems to be that, unlike the Chinese, they go to extraordinary lengths to hide their identities and objectives. FireEye analysts have even seen examples in which they have run “false-flag” cyber operations, designing their attack to appear as if it came from Asia.”

The Chinese malware that FireEye researchers have analyzed is not always the most advanced or created, but in many circumstances it is very effective, the report notes.

“China employs brute-force attacks that are often the most inexpensive way to accomplish its objectives,” according to FireEye. “The attacks succeed due to the sheer volume of attacks, the prevalence and persistence of vulnerabilities in modern networks, and a seeming indifference on the part of the cybercriminals to being caught.”

While Asia tends to be home to large, bureaucratic hacker groups such as the ‘Comment Crew’, Eastern European hacking groups tend to be more technically advanced and effective at evading detection, the FireEye notes. Western attacks, such as Stuxnet and Gauss, also tend to be highly engineered, the report says.

“The biggest challenge to deterring, defending against, or retaliating for cyber attacks is the problem of correctly identifying the perpetrator,” said Prof. John Arquilla of the Naval Postgraduate School, in a statement. “Ballistic missiles come with return addresses. But computer viruses, worms, and denial of service attacks often emanate from behind a veil of anonymity. The best chance to pierce this veil comes with the skillful blending of forensic “back hacking” techniques with deep knowledge of others’ strategic cultures and their geopolitical aims.”

But that is challenged by the use of false flag operations, and coupled with the use of evasion techniques hackers often have the upper hand.

“Given the notoriously difficult challenge of attack attribution, cyberspace is an ideal venue for false flag operations,” Geers said.

“If the attack is routed through a country with which the victim has poor diplomatic relations, what are the odds of effective law enforcement cooperation?”

Written By

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content


WASHINGTON - Cyberattacks are the most serious threat facing the United States, even more so than terrorism, according to American defense experts. Almost half...


Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet


Iranian APT Moses Staff is leaking data stolen from Saudi Arabia government ministries under the recently created Abraham's Ax persona


The war in Ukraine is the first major conflagration between two technologically advanced powers in the age of cyber. It prompts us to question...

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...


Russia-linked cyberespionage group APT29 has been observed using embassy-themed lures and the GraphicalNeutrino malware in recent attacks.

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...


A newly identified threat actor tracked as NewsPenguin has been targeting military organizations in Pakistan with sophisticated malware.