Group Behind 'Aurora' Attack on Google Still Active

New submitter trokez writes "Symantec has monitored the activities of a group using a specific trojan (Hydraq/Aurora) since 2009. The particular group has been connected (by Symantec) to the attack on Gmail in China, but also other high-profile attacks. 'These attackers have used a large number of zero-day exploits against not just the intended target organization, but also on the supply chain manufacturers that service the company in their cross hairs. These attackers are systematic and re-use components of an infrastructure we have termed the "Elderwood Platform." The term "Elderwood" comes from the exploit communication used in some of the attacks. This attack platform enables them to quickly deploy zero-day exploits.' The attacks seems to focus on industry espionage, with the defense industry and its suppliers at the focus."

Are these the dudes...

[Anonymous Coward]

...who hacked the gibson?

Watering Hole Attack.

[Tackhead]

From TFA:

One of the vectors of infection we're seeing a substantial increase in, called a âoewatering holeâ attack, is a clear shift in the attacking group's method of operations. The concept of the attack is similar to a predator waiting at a watering hole in a desert. The predator knows that victims will eventually have to come to the watering hole, so rather than go hunting, he waits for his victims to come to him. Similarly, attackers find a Web site that caters to a particular audience, which includes the target the attackers are interested in. Having identified this website, the attackers hack into it using a variety of means.

All well and good. The good folk at Symantec, a site that definitely caters to an audience of people who would be interested in this particular exploit, then goes on to link to their research paper:

We have published a research paper [bit.ly] that details the links between various exploits used by this attacking group, their method of targeting organizations, and the Elderwood Platform. It puts into perspective the continuing evolution and sheer resilience of entities behind targeted attacks.

That's right. The link to the research paper is, presumably by order of some marketroid who wants to get some metrics about this high-profile story (or are they?) is a goddamn bit.ly link redirector that goes directly to a PDF, and can be expected to spawn precisely one of the sorts of vectors that the attackers have been exploiting for years.

Peter Norton is still alive, but if he weren't, he'd be rolling in his grave. As it stands, he's merely rolling in a big pile of money.