Sunshop group linked to espionage attacks

By

The IE exploit was recently used in watering hole.

An espionage group is spreading a remote access trojan (RAT) and other malware with the help of three recently patched vulnerabilities in Java and Internet Explorer.


The Sunshop Group collective was behind the malicious activities and had compromised several websites including those owned by the Korean military and strategy think tanks,  according to FireEye researcher Ned Moran.

The IE zero-day was the same exploit used earlier this month in a watering hole attack against the US Department of Labor website.

The agency removed the compromised pages and the vulnerabilities were since patched.

Moran said the Sunshop Group also infected the Nobel Peace Prize's website back in 2010 using a Firefox zero-day in that instance.

In recent Sunshop attacks, users visiting compromised sites were redirected to a malicious page at a site called Sunshop – hence researchers' name for the group.

That site served victims a RAT known as Lady Boyle and additional malware, which include backdoor trojans.

This article originally appeared at scmagazineus.com

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Victoria's Secret pulls down website amid security incident

Victoria's Secret pulls down website amid security incident

Log In

  |  Forgot your password?