http://www.darkreading.com/threat-intelligence/167901121/security/attacks-breaches/240150216/time-bomb-attack-out-of-china-defused.html By Kelly Jackson Higgins Dark Reading Mar 06, 2013 Mandiant’s in-depth report published last month on a prolific cyberespionage team tied to the Chinese military was, in turn, used as a lure in other targeted attacks — by what appears to be different Chinese hacker groups. The attacks, spotted by Seculert, used a phony version of the report as a lure in a spearphishing attack against Japanese and Chinese journalists. The targeted attack against the Japanese victims came with an interesting twist: a “time bomb” element, according to Aviv Raff, CTO at Seculert. Mandiant’s report calls out the People’s Liberation Army Unit 61398 as the APT1 group responsible for cyberspying against multiple industries. The malware used in the attacks on Japanese journalists was programmed to trigger during 8 a.m. and 7 p.m. only, according to Raff. Raff says aside from the malware communicating with legitimate Japanese websites, it also came with another command-and-control domain in memory, one that was registered to a free dynamic DNS server and went to a Korea-based IP address. During the programmed time frame, the malware would communicate with “the real C2 server,” he says, rather than the legit Japanese websites. It also would then download additional malware. […] ______________________________________________ Visit the InfoSec News Security Bookstore Best Selling Security Books and More! http://www.shopinfosecnews.org