What’s in a name? When it comes to cybercriminal groups, their stated names — or the ones given to them by security researchers — often help set attacks in context or give some clue as to their methodology. Not so with Butterfly, recently changed from the moniker Morpho and previously known as Wild Neutron. Here, moniker and malice aren’t related but come with real risk: According to FierceITSecurity, the group has been active since 2013 and targets the intellectual property (IP) of private firms.

Big names like Apple, Facebook and Twitter were all compromised, along with legal and pharmaceutical firms. Now, commodity companies such as oil and gas producers are under threat from Butterfly/Morpho/Wild Neutron. How can businesses protect their intellectual assets?

Morpho Goes Name-Dropping

According to eWEEK, the Wild Neutron group was first identified and named by Kaspersky Lab in 2011, and it went after high-profile corporate IP in 2013. Last month, security firm Symantec detected the group at work again, this time targeting Fortune 200 commodity companies. They called the collective Morpho, which sounds at least somewhat ominous. But as noted by IT News, they were quickly informed by security and identity solutions firm Morpho that the name was already taken and has nothing to do with stealing IP, so Symantec quickly changed the tag to Butterfly.

The connection isn’t obvious, but the morpho is actually a type of Central American butterfly, helping to maintain at least some sense of continuity; unfortunately, any sense of urgency or threat was likely lost because the winged insects aren’t exactly high-profile predators.

A Well-Funded Group

Despite the name, Butterfly poses a serious threat to private corporations. According to CSO Online, the group is well-funded and uses fake certificates combined with watering-hole websites familiar to corporate users as a launch pad for its malware payload. Often, infection follows a new product launch or press release, when it’s most likely that a company will release research papers or have other critical documents on hand.

After getting in and grabbing the information needed, Butterfly deployments clean up the mess by deleting, rewriting and then redeleting critical malware files multiple times, making it nearly impossible to recreate the original code. In some cases, the group even paid for its own servers rather than hacking what’s available, but it paid for the hardware in small bitcoin transfers to avoid detection.

Vikram Thakur, senior manager at Symantec, believed that the Butterfly attacks are financially and not politically motivated, noting to CSO Online that the attackers are extremely careful with the information they obtain. So far, there’s no evidence of any high-profile IP for sale on the Dark Web, and while the data could be used for insider trading, there has been no odd stock market movement after the thefts occur. Vice president of security firm Fasoo, Ron Arden, said it’s possible that the group also employs insiders who are willing to deliberately compromise their accounts and give malicious actors access to five-year plans or financial statements.

Staying Butterfly-Free

Is it possible for companies to detect and defeat Butterfly attacks on their systems? Marta Janus of Kaspersky Lab told eWEEK that the group often uses Adobe Flash Player, so it’s a good idea to regularly update Flash and all third-party applications. Regular PC scanning and avoiding hacked forums are also on the list of preventative measures, but it’s a smart move to take proactive steps.

For example, if a company has just released new findings or described the arc of a new product launch to the media, it’s a safe bet that Butterfly attackers are listening in and poking around network edges for potential holes. It’s worthwhile to spend extra time monitoring and evaluating network behavior and reaffirming online best practices to prevent accidental infections.

Morpho/Wild Neutron/Butterfly can’t keep the same name, but the risk factor hasn’t changed: Affected companies could lose massive amounts of IP. Tread carefully — this butterfly is no lightweight.