Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

CYBER WAR AGAINST THE CORPORATE WORLD: A CASE STUDY OF CYBER INTRUSION131AccessData movedData downloadedControlsCompromised workstationStaging server(e-mail)Data copiedExfiltration hostExternal Webserver (underhacker control)C2 ComputerControlsCompany Y filerserverData copiedAccess Data moved Data downloadedCompromised workstationStaging server(e-mail)Exfiltration hostExternal Webserver (underhacker control)Perimeter of Company Y’s networkFIGURE 7.3 Diagram of the exfiltration route from the case study of Operation X on Company Y.success of the operation. After several of the files were exfiltrated outside the perimeter ofCompany Y’s network, security professionals detected the operation and stopped itmidsession. For 5 h after the security personnel stopped the exfiltration, Company Y’s networkstill received attempts from the hackers to return. Although it seems as if the hackersfelt they had not met their objectives, the security professionals were unable to determine theintended scope of Operation X. Further, as previously discussed, there was no way to identifywhat data were actually stolen (Figure 7.3).Evidence of Chinese InvolvementAs with Titan Rain, the evidence of Chinese involvement is circumstantial at best—thereare only indicators, but no direct proof. The main indicators of their involvement are someperceived slip ups of the cyber spies. For instance, due to the specific tools and techniquesused, certain activities on Company Y’s network attributed to the reconnaissance phase ofOperation X originated from PRC IP addresses. During exfiltration, one of the external machinesthat compromised a workstation in Company Y used as a “C2” machine was located inHong Kong.In addition to these blunders, the techniques, tools, and operational profile of the attackwere consistent with other attacks believed to originate from China during this time period(most likely attacks associated with Titan Rain). Further, the fact that the data were stolen