3 ms·

Source: https://www.symantec.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain https://www.symantec.com/blogs/threat-intelligence/tortoises... The S

by ga-vu 7y ago

Source: https://www.symantec.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain https://www.symantec.com/blogs/threat-intelligence/tortoises... The Symantec blog is actually more on point, while the Ars piece just picks and chooses what to cite. I also don't see why Ars calls these hackers "advanced." They use mundane Windows backdoors, like most hacker groups. Probably a FUD title on Ars' part.

ChrisSD 7y ago
It's unknown how the hackers gained access to install the backdoors. The article suggests, at least in one case, a web server was compromised but they don't know how. All they know is a web shell was installed in that one case.
C1sc0cat 7y ago
They are targeting sites in Saudi its not like they are going after "hard" targets
phaus 7y ago
Historically the term Advanced Persistent Threat has been used to refer to groups that appear to be a part of some kind of well funded/organized entity. It doesn't have much to do with the actual sophistication of the attack. However, an unusual level of sophistication could potentially be a piece of evidence that indicates a significant amount of resources one would only expect to see in a large company or government operation. Also, in this particular claim Symantec said the attacker used proprietary malware. Does't guarantee that it's advanced but that is something most small groups or individuals don't bother with. There are, of course, exceptions to everything. That's why it should ideally take a good amount of evidence gathered over a significant period of time to determine whether any given group is likely to be an APT. Another thing to consider is that even an advanced attacker gains nothing by using their most sophisticated techniques when drive-by downloads and malicious email links/attachments still work so well in 2019 that they account for the overwhelming majority of major data breaches.

by ga-vu 7y ago

ChrisSD 7y ago

It's unknown how the hackers gained access to install the backdoors. The article suggests, at least in one case, a web server was compromised but they don't know how. All they know is a web shell was installed in that one case.

C1sc0cat 7y ago

They are targeting sites in Saudi its not like they are going after "hard" targets

phaus 7y ago

Historically the term Advanced Persistent Threat has been used to refer to groups that appear to be a part of some kind of well funded/organized entity. It doesn't have much to do with the actual sophistication of the attack. However, an unusual level of sophistication could potentially be a piece of evidence that indicates a significant amount of resources one would only expect to see in a large company or government operation. Also, in this particular claim Symantec said the attacker used proprietary malware. Does't guarantee that it's advanced but that is something most small groups or individuals don't bother with. There are, of course, exceptions to everything. That's why it should ideally take a good amount of evidence gathered over a significant period of time to determine whether any given group is likely to be an APT. Another thing to consider is that even an advanced attacker gains nothing by using their most sophisticated techniques when drive-by downloads and malicious email links/attachments still work so well in 2019 that they account for the overwhelming majority of major data breaches.