Publicación: Análisis forense de una APT
Cargando...
Fecha
2022
Autores
Editor/a
Tutor/a
Coordinador/a
Prologuista
Revisor/a
Ilustrador/a
Derechos de acceso
info:eu-repo/semantics/openAccess
Título de la revista
ISSN de la revista
Título del volumen
Editor
Universidad Nacional de Educación a Distancia (España). Escuela Técnica Superior de Ingeniería Informática. Departamento de Sistemas de Comunicación y Control
Resumen
Desde 2004, Mandiant ha examinado problemas de seguridad informática en muchas organizaciones de todo el mundo. La mayoría de estas infracciones de seguridad se deben a actores de amenazas avanzadas denominados Advanced Persistent Threat (APT), amenaza permanente avanzada, en español. Los datos que han sido analizados durante cientos de investigaciones nos convencen de que los grupos que realizan estas actividades se realizan en China. En cuanto a la descripción del trabajo realizado, existe un APT conocido como "APT1", y es uno de más de 20 grupos APT con orígenes en China. APT1 es una organización única de atacantes que ha llevado a cabo una campaña de ciberespionaje contra muchas víctimas desde por lo menos 2006. Según las observaciones, es uno de los grupos de espionaje cibernético con más éxito en términos de la gran cantidad de información robada. Aunque la visibilidad de las actividades de APT1 no es completa, han sido analizadas las intrusiones del grupo contra más o menos 150 víctimas durante siete años. Fue descubierta una gran cantidad de la infraestructura de ataque de APT1 (herramientas, tácticas y procedimientos). Creemos que APT1 es capaz de emprender una campaña de ciberespionaje de muy larga duración. En gran parte porque recibe apoyo directo del gobierno. Al tratar de identificar la organización detrás de esta actividad, la investigación encontró que la Unidad 61398 del Ejército Popular de Liberación (EPL) es similar a APT1 en su misión, capacidades y recursos. La Unidad PLA 61398 también está precisamente en la misma área desde la que parece originarse la actividad APT1. La unidad 61398 está situada en Datong Road (大同路) en Gaoqiaozhen (高桥镇), que se encuentra en Pudong (浦东新区) de Shanghai (上海). El edificio principal de esta infraestructura es una instalación de 130,663 pies cuadrados con 12 pisos de altura y fue construido a principios de 2007. En cuanto a la descripción del trabajo realizado, es un trabajo de análisis y de aplicación de una serie de aspectos relacionados con el APT1, abarcando tanto aspectos teóricos como prácticos. Dichos aspectos se explicarán de forma ordenada a lo largo de esta memoria, dividida en bloques bastante diferenciados entre sí y con temas muy concretos explicados en dichos bloques.
Since 2004, Mandiant has examined information security issues in many organizations around the world. Most of these security breaches are due to advanced threat actors called Advanced Persistent Threat (APT). The data that has been analyzed during hundreds of investigations convinces us that the groups that carry out these activities are in China. There is an APT known as "APT1", and it is one of more than 20 APT groups with origins in China. APT1 is a unique organization of attackers that has carried out a cyber espionage campaign against many victims since at least 2006. According to observations, it is one of the most successful cyber espionage groups in terms of the large amount of information stolen. Although the visibility of APT1's activities is not complete, the group's intrusions against roughly 150 victims over seven years have been analyzed. A large amount of APT1's attack infrastructure (tools, tactics, and procedures) was discovered. We believe that APT1 is capable of undertaking a very long-term cyber espionage campaign. Largely because it receives direct support from the government. In trying to identify the organization behind this activity, the investigation found that Unit 61398 of the Popular Liberation Army (EPL) is similar to APT1 in its mission, capabilities, and resources. PLA Unit 61398 is also in precisely the same area from which the APT1 activity appears to originate. Unit 61398 is located at Datong Road (大同路) in Gaoqiaozhen (高桥镇), which is in Pudong (浦东新区) of Shanghai (上海). The main building of this infrastructure is a 130,663-square-foot facility which has 12 floors and was built in early 2007. Regarding the description of the work carried out, it is a work of analysis and application of a series of aspects related to the APT1, covering both theoretical and practical aspects. These aspects will be explained in an orderly manner throughout this memory, divided into blocks that are quite different from each other and with very specific topics explained in the blocks.
Since 2004, Mandiant has examined information security issues in many organizations around the world. Most of these security breaches are due to advanced threat actors called Advanced Persistent Threat (APT). The data that has been analyzed during hundreds of investigations convinces us that the groups that carry out these activities are in China. There is an APT known as "APT1", and it is one of more than 20 APT groups with origins in China. APT1 is a unique organization of attackers that has carried out a cyber espionage campaign against many victims since at least 2006. According to observations, it is one of the most successful cyber espionage groups in terms of the large amount of information stolen. Although the visibility of APT1's activities is not complete, the group's intrusions against roughly 150 victims over seven years have been analyzed. A large amount of APT1's attack infrastructure (tools, tactics, and procedures) was discovered. We believe that APT1 is capable of undertaking a very long-term cyber espionage campaign. Largely because it receives direct support from the government. In trying to identify the organization behind this activity, the investigation found that Unit 61398 of the Popular Liberation Army (EPL) is similar to APT1 in its mission, capabilities, and resources. PLA Unit 61398 is also in precisely the same area from which the APT1 activity appears to originate. Unit 61398 is located at Datong Road (大同路) in Gaoqiaozhen (高桥镇), which is in Pudong (浦东新区) of Shanghai (上海). The main building of this infrastructure is a 130,663-square-foot facility which has 12 floors and was built in early 2007. Regarding the description of the work carried out, it is a work of analysis and application of a series of aspects related to the APT1, covering both theoretical and practical aspects. These aspects will be explained in an orderly manner throughout this memory, divided into blocks that are quite different from each other and with very specific topics explained in the blocks.
Descripción
Categorías UNESCO
Palabras clave
Mandiant, APT1, JIB, SilK, Internet Census 2012, fingerprint, synscan, service probe, WEBC2-DIV
Citación
Centro
Facultades y escuelas::E.T.S. de Ingeniería Informática
Departamento
Sistemas de Comunicación y Control