View source for Attackers place Command and Control servers inside enterprise walls

{{Publication
|Link=http://www.securityweek.com/new-attack-method-puts-command-and-control-servers-inside-enterprise-walls
|Author=Brian Prince
|Date=2012-04-30
|Editor=Security Week
|Year=2012
|Botnet=Waledac
|Abstract=Stealthy Attacks Use Trusted Enterprise Systems and Trusted Networks, Making Detection Difficult

Skilled attackers are burrowing their command and control (C&C) servers inside the networks of compromised businesses in order to circumvent security measures, according to a security expert familiar with the innovative new attack method.

The tactic is the latest twist in attempts by botnet operators to launch advanced persistent threats (APTs) that can stay below the radar while compromising corporate resources.

“We’ve been seeing this for the last four or five months,” Tom Kellermann, vice president of cybersecurity at Trend Micro told SecurityWeek. “I think it’s really significant when you look at incident response techniques and how this can defeat most of those…everyone keeps assuming that nation states are the only ones launching APTs…but in fact we’re seeing tremendous innovation of this technology by criminal crews.”

According to Kellermann, Trend Micro has observed dozens of incidents were these tactics have been used. In many cases, the compromised servers being used for C&C were compromised in previous attacks and hackers were able to maintain access, he said. The technique helps attackers to stay stealthy as they exfiltrate data, as very little C&C traffic is leaving the network.
|Keyword=APT, C&C
}}