Maritime Computer Emergency Response Team ADMIRAL dataset ADMIRAL dataset

Publicly disclosed information for this event

Index Number:
Title:
2012_002
Spearphishing campain targeting the naval sector.
Day Month Year Country Activity Incident Type
01 September 2012 United States Defence Spearphishing

Summary

According to sources, the victim faced cyber intrusions starting in 2009, with the deployment of the Hydraq (Aurora) Trojan horse being a prominent method. Over the subsequent years, the attackers systematically exploited several zero-day vulnerabilities, notably on Adobe and Microsoft products (CVE-2012-0779, CVE-2012-1875, CVE-2012-1889 and CVE-2012-1535). The Tactics, Techniques, and Procedures (TTPs) of the attacks seem to correspond with activities reputed of a group associated with the "Elderwood Platform." Furthermore, there was a noticeable shift in their methods, with an increase in "watering hole" techniques, compromising specific websites expected to be visited by targets.

The repercussions of these incidents for the victim could be multifaceted. Operational disturbances might have arisen due to the deployment of the mentioned zero-day vulnerabilities, potentially jeopardizing sensitive intellectual property. These intrusions might have also facilitated unauthorized access to top-tier defense contractors by using the victim as an intermediary. Given the escalated use of "watering hole" attacks, a vast amount of data may have been at risk, though the specifics on the type and extent of data remain uncertain.

Victim

Lockheed Martin

Claimed/Reported Threat Actor

The Elderwood Gang

Origin

Political

Main impact

Confidentiality

References

Recommendations to Defence to reduce Spearphishing risks:

  • Implement advanced email filtering systems to detect and block spearphishing emails.
  • Educate employees about the dangers of spearphishing and how to identify suspicious emails.
  • Enforce strict email access controls and authentication measures.
  • Implement organizational measures to avoid scam.
  • Limit the use of social networks or unallowed medias for profesionnal activities.
  • Monitor for unusual email activity, such as unexpected login attempts.
  • Work with your CSIRT organization to know the Tactics, Techniques and Procedures used.
Previous Next
Disclaimer: the data are provided as is. France Cyber Maritime and the M-CERT take no responsibility for the soundness, quality, precision, nor the eventual attribution made by the referenced URLs. We give a lot of respect and support to the victims of attacks. Yes, there are no common and shared incident IDs in cyber (for now!).
Files generated on Thursday, 02nd November 2023.
ADMIRAL is licensed under the Creative Commons CC-BY-NC license. Copyright © France Cyber Maritime 2023.