Earlier this year, the second largest health insurance provider in the US publicly disclosed that it had been the victim of a major cyberattack. The attack against Anthem resulted in the largest known healthcare data breach to date, with 80 million patient records exposed.
Symantec believes that the attackers behind the Anthem breach are part of a highly resourceful cyberespionage group called Black Vine. The Anthem attack is only one of multiple campaigns that Symantec has attributed to this group.
Symantec’s latest whitepaper documents multiple Black Vine operations that have been occurring since 2012. Black Vine’s targets include gas turbine manufacturers, large aerospace and aviation companies, healthcare providers, and more. The group has access to zero-day exploits, most likely obtained through the Elderwood framework, and uses custom-developed back door malware.
By connecting multiple Black Vine campaigns, we traced how the attack group has evolved over the last three years.
Background
Black Vine’s attacks to date delivered exploits for the following zero-day vulnerabilities, primarily through watering-hole attacks:
In its campaigns, Black Vine compromised legitimate websites that were of interest to its targets in order to serve exploits to the sites’ visitors. If the zero-day exploits successfully worked against the vulnerable software on the victim’s computer, then they dropped Black Vine’s custom malware, providing the attackers with remote access to the computer. In addition to watering-hole attacks, Black Vine also sent spear-phishing emails that disguised its threats using technology-themed lures.
Black Vine has compromised companies in the following industries:
- Aerospace
- Healthcare
- Energy (gas & electric turbine manufacturing)
- Military and defense
- Finance
- Agriculture
- Technology
The vast majority of Black Vine malware infections were located in the US, followed by China, Canada, Italy, Denmark, and India.
Figure. Black Vine malware infections by region
Malware
Symantec observed Black Vine using three types of custom malware throughout its campaigns: Hurix and Sakurel (both detected as Trojan.Sakurel), and Mivast (detected as Backdoor.Mivast).
All three threats can perform the following actions:
- Open a back door
- Execute files and commands
- Delete, modify, and create registry keys
- Gather information from the infected computer
Our analysis suggests that Black Vine is well resourced, as the group is capable of frequently updating and modifying its malware to avoid detection.
The Elderwood connection
During our analysis, we noticed that Black Vine used certain zero-day exploits at the same time that other attack groups used them. The other campaigns have been previously investigated by Symantec, such as one by Hidden Lynx.
While these campaigns included the same zero-day exploits, they delivered different payloads unique to each attack group. The fact that these different adversaries simultaneously used the same exploits suggests that they all have access to a common zero-day exploit distribution framework.
Symantec has previously identified the framework in question as the Elderwood platform. We first researched the platform in 2012 and observed how it has been continuously updated with the latest zero-day exploits ever since. In 2014, we discovered that several attack groups were likely using the Elderwood framework, rather than just one. All of the campaigns that leveraged Elderwood’s zero-day exploits have been attributed to attackers based in China.
Other reports suggest that some of the actors involved in Black Vine’s activity may have had connections with a Beijing-based IT security firm called Topsec.
Conclusions
Black Vine is a formidable, highly resourced attack group which is equipped to conduct cyberespionage against targeted organizations. Based on our records of its past campaigns, Symantec believes that Black Vine’s malicious activity will continue.
We hope that our whitepaper will allow organizations to better understand the risk that this attack group poses, helping them to develop stronger defenses for their sensitive information.
Protection
Symantec has the following detections in place to protect against Black Vine’s malware:
Antivirus
Intrusion prevention system
Further reading
For a complete account of Symantec’s investigation into Black Vine and its campaigns, please read our whitepaper.
