View source for Unveiling an Indian cyberattack infrastructure - a special report

{{Publication
|Type=White paper
|Link=http://enterprise.norman.com/resource_center/unveiling_an_indian_cyberattack_infrastructure-a_special_report entreprise.norman.com
|Author=Snorre Fagerland, Morten Kråkvik, Jonathan Camp, Ned Moran
|Date=2013-05
|Editor=Norman
|Year=2013
|Botnet=HangOver
|Malware=Hanove
|Abstract=On March 17, 2013 a Norwegian newspaper reported that the country’s telecommunications giant Telenor had filed a criminal police case for an unlawful computer intrusion. Spear phishing emails targeting upper management appeared to be the source of the infection.  Through extensive analysis, security analysts at Norman Shark, in conjunction with our partners, quickly uncovered a previously unknown and sophisticated infrastructure for targeted attacks.

Our report details a sophisticated cyberattack infrastructure that appears to originate from India, conducted by private threat actors with no evidence of state-sponsorship.  It has likely been in operation for over three years, primarily as a platform for surveillance against targets of national security interest that are mostly based in Pakistan and possibly in the United States. It is also used for industrial espionage against the Norwegian telecom corporation Telenor and other civilian corporations. Evidence points to professional project management and outsourcing of key tasks, including some by freelance programmers.

In this report we detail a cyberattack infrastructure that appears to be Indian in origin. This infrastructure has been in operation for at least three years, more likely close to four years. The purpose of this framework seems predominantly to be a platform for surveillance against targets of national security interest (such as Pakistan), but we will also show how it has been used for industrial espionage against the Norwegian telecom corporation Telenor and other civilian corporations.
}}