Home » News » Previously unknown governmental group Avivore attacked airbus

Previously unknown governmental group Avivore attacked airbus

Researchers at Context Information Security have identified a new cybercriminal group Avivore, which has attacked Airbus several times over the past few months.

Attackers carried out cyber attacks on Airbus through the networks of French consulting company Expleo, British engine manufacturer Rolls Royce, and two unnamed Airbus suppliers.

Cybercriminals target large multinational and small engineering and consulting firms in supply chains.

As part of Island hopping attacks (attacks on supply chains), cybercriminals use the connection between the victim and its partners, for example, virtual private networks (VPNs), to penetrate computer networks.

“Previous reports of recent incidents involving the aerospace and defense industries have linked them to APT10 and the Ministry of State Security of Jiangsu Province [China]. Although the nature of the activity of criminals complicates attribution, the analysis of the campaign indicates a new group, which we called Avivore,” – said Oliver Fay, chief analyst of Context Information Security.

According to the researchers, the group uses the PlugX Remote Access Trojan (RAT), which was often used by APT10.

However, group tactics, techniques, and procedures, as well as infrastructure and other tools, significantly differ it from Chinese cybercriminals. This fact allowed experts concluding that Avivore is a previously unknown group sponsored by the government.

Read also: Criminals attacked US oil companies using Adwind Trojan

Criminals are “very capable”, because they skillfully use a technique called living-off-the-land (using local applications for malicious purposes) and mask their activities in the daily business activities of employees of target companies. They also maintain operational safety and remove all traces to avoid detection.

READ  PoC-code for vulnerability in Apache HTTP-server published on GitHub

Based on the information and assets sought by AVIVORE, Context Information Security assesses with moderate confidence that the objective of the recent campaign was intellectual property theft from victim organizations.

Future Recommendations and Mitigations from Context Information Security:

  • Impose access limitations on supplier connections over VPNs and restrict access only to data and assets they require to perform their actions.
  • Ensure that security measures, such as multifactor authentication and enhanced auditing/logging are deployed to hosts and services into which suppliers are required to connect.
  • Ensure that external remote access services implement appropriate log retention. Logs should contain enough information on the sources of inbound connections to enable identification of anomalies, such as concurrent log-ins with impossible geography.
  • Ensure that credentials for highly privileged accounts and remote services are stored securely, and their use is appropriately monitored.
  • Where possible, applications, documentation and technical information related to network infrastructure and configuration of remote access services should be made available only to engineers and IT support staff.
[Total: 0    Average: 0/5]

About Trojan Killer

Carry Trojan Killer Portable on your memory stick. Be sure that you’re able to help your PC resist any cyber threats wherever you go.

Check Also

MageCart on the Heroku Cloud Platform

Researchers Found Several MageCart Web Skimmers On Heroku Cloud Platform

Researchers at Malwarebytes reported about finding several MageCart web skimmers on the Heroku cloud platform …

Android Spyware CallerSpy

CallerSpy spyware masks as an Android chat application

Trend Micro experts discovered the malware CallerSpy, which masks as an Android chat application and, …

Leave a Reply