July 12, 2016 By Douglas Bonderud 2 min read

Advanced persistent threats (APTs) are now on the security radar. As noted by BizTech Magazine, 49 percent of enterprises surveyed believe it is “very likely” they will come under fire from these sophisticated threats. Just 15 percent, however, said they were “very prepared” to deal with an APT attack.

According to eWEEK, meanwhile, things may get worse before they get better: Security firm Cymmetria has discovered a new APT named Patchwork, which uses copy-pasted code to carry out its dirty work.

It’s All Been Done Before

Cymmetria first noticed Patchwork in December of last year. Since then, the malware has compromised 2,500 government agencies and companies across Southeast Asia. Upon closer inspection, the security firm discovered a common infection vector: targeted spear phishing using a malicious PowerPoint attachment.

But instead of using new code or a clever variant of existing vulnerabilities, the APT simply leverages CVE-2014-4114 — also known as Sandworm — to infect target machines. Sandworm was patched by Microsoft in 2014.

Once compromised, Patchwork uses the open-source Meterpreter to carry out a reverse shell attack and gain total device access. Cymmetria Founder Gadi Evron put the criminals’ reuse of existing exploits into context in a recent Threatpost piece.

“Those behind these attacks have copied, pasted and pieced together everything from penetration tools, malware and post-intrusion attack tools,” Evron told the source. In other words, why should criminals reinvent the wheel when they can roll in on someone else’s tires and take off with critical data?

Patchwork Sets a Low Bar

According to Infosecurity Magazine, much of the criminals’ new code came from GitHub code repositories and Dark Web malware sites. The result is a kind of low-tech hybrid that shouldn’t really enjoy any measure of success.

It’s also notable that the malware is potentially of Indian origin because the country has been relatively quiet in the world of cybercrime. It might be this lack of experience that led to a copy-and-paste job rather than a new build, or it may have been the appeal of simply getting the code out in the wild.

Whatever the reason, the code has been successful at infiltrating specific targets, such as those organizations connected to military or political endeavors — despite its piecemeal nature. The idea that Patchwork enjoys success greater than the sum of its parts is the most worrisome aspect of this APT.

It’s a wake-up call for organizations: If even cobbled-together code can smash through corporate defenses to grab critical data, what happens when someone decides to build a new malware model?

Bottom line? The 85 percent are right: They’re not prepared to handle an APT attack, even one like Patchwork. It’s time to start stitching together a better digital defense.

More from

Autonomous security for cloud in AWS: Harnessing the power of AI for a secure future

3 min read - As the digital world evolves, businesses increasingly rely on cloud solutions to store data, run operations and manage applications. However, with this growth comes the challenge of ensuring that cloud environments remain secure and compliant with ever-changing regulations. This is where the idea of autonomous security for cloud (ASC) comes into play.Security and compliance aren't just technical buzzwords; they are crucial for businesses of all sizes. With data breaches and cyber threats on the rise, having systems that ensure your…

Adversarial advantage: Using nation-state threat analysis to strengthen U.S. cybersecurity

4 min read - Nation-state adversaries are changing their approach, pivoting from data destruction to prioritizing stealth and espionage. According to the Microsoft 2023 Digital Defense Report, "nation-state attackers are increasing their investments and launching more sophisticated cyberattacks to evade detection and achieve strategic priorities."These actors pose a critical threat to United States infrastructure and protected data, and compromising either resource could put citizens at risk.Thankfully, there's an upside to these malicious efforts: information. By analyzing nation-state tactics, government agencies and private enterprises are…

6 Principles of Operational Technology Cybersecurity released by joint NSA initiative

4 min read - Today’s critical infrastructure organizations rely on operational technology (OT) to help control and manage the systems and processes required to keep critical services to the public running. However, due to the highly integrated nature of OT deployments, cybersecurity has become a primary concern.On October 2, 2024, the NSA (National Security Agency) released a new CSI titled “Principles of Operational Technology Cybersecurity.” This new guide was created in collaboration with the Australian Signals Directorate’s Australian Cyber Security Centre (ASD SCSC) to…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today