IT now stands for Intermediate Targets: Tech providers pwned by snoops eyeing up customers – report

Miscreants are hacking into Saudi Arabian IT providers in an attempt to compromise their real targets: said providers' customers, according to Symantec.

The security software giant said this week its attack investigation team has observed the cyber-gang, dubbed Tortoiseshell, infiltrating the networks of off-premises cloud businesses and tech suppliers in the hope of gaining access to their users, and siphon off data, spy, and do other mischief

Symantec said the hacking crew, active from at least July of last year through July of this year, compromised hundreds of computers within 11 service providers, and exploited this high level of access to menace its actual targets.

"This is an unusually large number of computers to be compromised in a targeted attack," Symantec said in a summary on Wednesday.

"It is possible that the attackers were forced to infect many machines before finding those that were of most interest to them."

The operation is a highly effective new spin on the supply-chain attack concept, in which a crook uses a partner company as the point of entry to a target's network.

Hey China, while you're in all our servers, can you fix these support tickets? IBM, HPE, Tata CS, Fujitsu, NTT and their customers pwned

READ MORE

"IT providers are an ideal target for attackers given their high level of access to their clients’ computers," Symantec noted.

"This access may give them the ability to send malicious software updates to target machines, and may even provide them with remote access to customer machines."

It also makes detection of an incoming threat by the targets themselves nearly impossible until it is too late. In at least two of the cases, the hackers ended up being able to navigate the provider's network with domain admin clearance, we're told.

This means the snoops would be able to not only access everything on the IT provider's network, but also create additional accounts and remotely control machines, potentially.

The Symantec team noted the attackers used some of the same malware as the Iran-based OilRig cyber-espionage group, though we've been cautioned against drawing any connections, as those tools have been in the public domain since they were leaked in April.

Because it was the service providers that were infected, Symantec can't say who the ultimate targets were, and there is of yet no way to definitively connect the attack to any group or nation. ®