Operation Blockbuster Brings the Fight to Sony Hackers

Operation Blockbuster, a coalition of security companies led byNovetta, on Wednesday published a report detailing the activities of the Lazarus Group, the organization responsible for the 2014 cyberattack against Sony Pictures Entertainment.

Researchers last week published detection signatures to the companies’ respective software in the hope of disrupting the group’s activities.

The coalition’s response has heavily wounded the malware arsenal the attackers used but has not eliminated the threats worldwide, Operation Blockbuster said.

Last year, researchers began identifying several malware hashes publicized by the security community following the Sony attack. From those hashes they established a baseline of the malware capabilities, common code and libraries used in the malware samples, according to the report.

They used the fragments of code and library functions to detect additional malware samples. They used proprietary tools and Totem, an open source Novetta-developed framework for large-scale file analysis and triage.

Refining that process led researchers to detect and analyze more than 45 distinct malware families related to the Sony malware, according to Brian Bartholomew, a researcher at coalition memberKaspersky Lab.

“I think we are definitely putting a dent in their operation. I don’t think it is going to make them disappear, but it is definitely causing them some headaches,” he told the E-Commerce Times.

Other members of Operation Blockbuster include AlienVault, Invincea, PunchCyber, Symantec, ThreatConnect and Volexity.

Measured Tactics

The Lazarus Group has conducted multiple attacks over at least six years, the most-well-known being the attack against Sony. The group also is responsible for some 43 malware families, said Bartholomew.

“They moved the line in the sand. They are still out there and functioning,” he said.

The malware definitely poses a real threat all over the world, Bartholomew said. The attackers were not very selective about their targets, and they have played by a different set of rules.

Still, the progress the coalition has made in countering the massive malware attacks is impressive, according to Andrew Ludwig, senior technical director at Novetta who led the report.

“The biggest change comes with the identification and analysis of such a vast array of unique malware tools and capabilities that are all interrelated,” he told the E-Commerce Times.

Ever Present Threat

Hacking groups are spawning because hacking is effective in cybercrime and cyber espionage.

Revelation of the activities conducted by the Lazarus Group is proof of the growing problem, according to Ben Johnson, chief security strategist atCarbon Black.

“The big reveal that the Lazarus Group exists does not increase or change the current state of the threat landscape. It underscores that there are many other groups like this one that are acting with the intent to exfiltrate valuable data from an organization, potentially pin their attack on another group or country and act in accordance with whatever code they have set forth,” told the E-Commerce Times.

The details the report provides does little to change the malware landscape, noted Jeff Reingold, co-founder ofPanurgy. All that’s new are reported details of the multiyear efforts and investigation by Novetta and others to gain more detail into who was behind the Sony Pictures attack, the specific malware code and techniques used.

“While the results of the investigation may help make a dent in the possible further damage that could be done by Lazarus or others using those same malware tools, it does not change the landscape much regarding ongoing and future attacks aimed at data theft and/or destruction,” he told the E-Commerce Times.

What To Do About It

A good defense and a strong offense are tactics to continue countering malware organizations.

The Operation Blockbuster report suggests that the Lazarus Group is a formidable threat actor capable of causing reputational and operational harm, noted Norman Comstock, researcher for theBerkeley Research Group.

It accomplishes this “by exfiltrating and leaking data, impairing system availability or recoverability with great patience and obfuscation,” he told the E-Commerce Times.

A full-frontal counterattack across borders poses many risks, noted Nathan Wenzler, executive director of security atThycotic.

Dealing with a politically volatile group makes it difficult for cyberattack victims to do anything directly without it being seen as an act of aggression or even an act of war, he told the E-Commerce Times.

“Barring that, however, there are many defensive measures that corporations and government agencies should be implementing in order to defeat the types of attacks coming out of this group,” Wenzler said.