Aurora, Other Zero-Day Attacks Linked In 'Elderwood' Study

The infamous Aurora Trojan horse is just one of many attacks launched by the same group of malware authors over the past three years, according to researchers at Symantec.

In a reportposted earlier this week, the researchers link a series of attacks that re-use components of an infrastructure they call the "Elderwood Platform." The attack platform enables the malware authors to quickly deploy zero-day exploits, according to the report.

"Serious zero-day vulnerabilities, which are exploited in the wild and affect a widely used piece of software, are relatively rare; there were approximately eight in 2011," the researchers say. "The past few months, however, has seen four such zero-day vulnerabilities used by the Elderwood attackers...we have seen no other group use so many. The group seemingly has an unlimited supply of zero-day vulnerabilities."

The primary targets of these attacks are usually members of the defense supply chain, the Symantec researchers say. "These are companies who manufacture electronic or mechanical components that are sold to top-tier defense companies. The attackers do so expecting weaker security postures in these lower-tier organizations, and may use these manufacturers as a stepping-stone to gain access to top-tier defense contractors."

The long-term reuse of components, the frequent use of zero-day exploits, and the sophistication of the attacks all point to a stable and skilled group of malware authors, probably supported by organized crime or a nation state, the researchers say.

Have a comment on this story? Please click "Add a Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.