Researchers at security firm FireEye, Inc. (FEYE - Nasdaq) reported on Wednesday that, Russian government-backed hackers used the unusual tandem as a means of communicating with previously infected U.S. government and defense industry computers.
According to FireEye, hackers penetrated high-profile computers this year, used a method combining Twitter, Inc. (TWTR - NYSE) with data hidden in seemingly benign photographs.
During an investigation by FireEye at an unnamed victim organization, the technique shows how government-backed hackers can shift tactics on the fly after they are discovered.
Jennifer Weedon, FireEye Strategic Analysis Manager said, “It’s striking how many layers of obfuscation that the group adopts. These groups are innovating and becoming more creative.”
The computers were given an algorithm for checking a different Twitter account every day. Instructions for a series of actions by the computer would be activated if a human agent registered that Twitter account and tweeted a certain message.
The tweeted information included a website address, a number and a handful of letters that were part of a key for decoding the instructions in a message hidden within the data used to display the picture on the website. The computer would load the website address and look for a photo of at least the size indicated by the number. The communication method might have been a failsafe in case other channels were discovered and cut, per Weedon.
The hacking campaign carried out by the group has been internally called APT29, for advanced persistent threat, by FireEye.
Contributed by Millennium Traders
Sections
Categories