Kaspersky Finds New Nation-State Attack—In Its Own Network - WIRED

WIRED, by Kim Zetter

Researchers at Kaspersky Lab in Russia have discovered yet another new nation-state attack attributed to members of the infamous Stuxnet and Duqu gang. But this time the perpetrators were hiding in plain sight—inside the security firm’s own networks.

Kaspersky says the attackers became entrenched in its networks some time last year. For what purpose? To siphon intelligence about nation-state attacks the company is investigating—a case of the watchers watching the watchers who are watching them. They also wanted to learn how Kaspersky’s detection software works so they could devise ways to avoid getting caught. Too late, however: Kaspersky found them recently while testing a new product designed to uncover exactly the kind of attack the intruders had launched.

The attackers appear to be the same group that created Duqu, spyware discovered in 2011 that was used to hack a certificate authority in Hungary, as well as targets in Iran and Sudan, and that shared a number of similarities with Stuxnet, the famed digital weapon that sabotaged Iran’s nuclear program. The team’s handiwork popped up again in 2012 in two sophisticated spy tools Kaspersky helped expose—the massive Flame surveillance platform that infected thousands of victims over a period of five years and the mysterious Gauss attack, which contained a payload so securely locked that it’s yet to be deciphered. Read more.