Industrial espionage is alive and well in the cloud age. In some cases, corporations leave themselves inherently vulnerable to such attacks. In other cases, as Softpedia noted, they may be targeted by ancient password stealers hosted on compromised web servers.

Either way, company secrets are at risk. Whether breaches originate from served-up server attacks or C-suite missteps, organizations must be cognizant of their intellectual risk.

Old Tricks Still Effective

While sophisticated cybercrime techniques are emerging as malicious actors improve their craft, it’s often more effective for cybercriminals to use existing, proven tools. That’s the case with McAfee’s latest find, a compromised web server running the ISR Stealer package, itself a modified Hackhound infostealer module that made its debut in 2009.

Thanks to some sloppy work by cybercriminals, McAfee’s teams discovered the command-and-control (C&C) server’s ZIP installation package, uncovered its source code and found that the industrial espionage campaign wasn’t ancient history — it actually started in January 2016, targeting machinery manufacturing companies.

Attackers used spear phishing emails containing malicious attachments to spread the malware, which could lift passwords from IE, Chrome, Firefox, Opera, Safari, Yahoo, MSN and other programs. The malware would then send password data to the C&C server via an HTTP request.

While there’s no data on how many companies were compromised or what information was stolen, the compromised web server makes it clear: Age doesn’t matter if users can be convinced to open malicious attachments.

The New Face of Industrial Espionage

Of course, fighting off old industrial espionage tricks is only half the battle. As noted by The Recorder, companies now struggle with bring-your-own-cloud (BYOC) scenarios.

In one example, an organization encouraged an employee to create a Box storage account that pushed copies of all files saved to the company laptop to the cloud. When the employee changed jobs, the original employer made no effort to disable the account or restrict access. In turn, the employee shared confidential pricing information with a competitor at the new job.

According to SC Magazine, there are also concerns around new apps such as “Pokemon Go.” Alexander Gorokhov, formerly a major-general in the Russian Federal Security Service, said that mobile apps may pose a serious threat to national security as “highly effective” cyber espionage tools.

New Challenges in the Age of Cloud

Put simply, industrial espionage is on the way up in the age of cloud computing. Compromised web servers running ancient malware offer near-limitless access if attackers can get their foot in the door. Meanwhile, new challenges such as BYOC and mobile games represent a shift to dynamic and constantly evolving threats to intellectual property.

While there’s no surefire way to secure networks, oversight must be the backbone of IT. Email attachments are always suspect. New apps must be limited in scope and access, and cloud services can’t be ignored simply because they’re easy or off-site. IP is valuable, so cybercriminals won’t limit themselves to a single threat vector.

More from

New Attack Targets Online Customer Service Channels

An unknown attacker group is targeting customer service agents at gambling and gaming companies with a new malware effort. Known as IceBreaker, the code is capable of stealing passwords and cookies, exfiltrating files, taking screenshots and running custom VBS scripts. While these are fairly standard functions, what sets IceBreaker apart is its infection vector. Malicious actors are leveraging the helpful nature of customer service agents to deliver their payload and drive the infection process. Here’s a look at how IceBreaker…

Operational Technology: The evolving threats that might shift regulatory policy

Listen to this podcast on Apple Podcasts, Spotify or wherever you find your favorite audio content. Attacks on Operational Technology (OT) and Industrial Control Systems (ICS) grabbed the headlines more often in 2022 — a direct result of Russia’s invasion of Ukraine sparking a growing willingness on behalf of criminals to target the ICS of critical infrastructure. Conversations about what could happen if these kinds of systems were compromised were once relegated to “what ifs” and disaster movie scripts. But those days are…

Cybersecurity 101: What is Attack Surface Management?

There were over 4,100 publicly disclosed data breaches in 2022, exposing about 22 billion records. Criminals can use stolen data for identity theft, financial fraud or to launch ransomware attacks. While these threats loom large on the horizon, attack surface management (ASM) seeks to combat them. ASM is a cybersecurity approach that continuously monitors an organization’s IT infrastructure to identify and remediate potential points of attack. Here’s how it can give your organization an edge. Understanding Attack Surface Management Here…

Six Ways to Secure Your Organization on a Smaller Budget

My LinkedIn feed has been filled with connections announcing they have been laid off and are looking for work. While it seems that no industry has been spared from uncertainty, my feed suggests tech has been hit the hardest. Headlines confirm my anecdotal experience. Many companies must now protect their systems from more sophisticated threats with fewer resources — both human and technical. Cobalt’s 2022 The State of Pentesting Report found that 90% of short-staffed teams are struggling to monitor…