Tracking GhostNet: Investigating a Cyber Espionage Network
Download Size : 14 MB
The provided report, "Tracking GhostNet: Investigating a Cyber Espionage Network," details a 10-month investigation by the Information Warfare Monitor (IWM) into a sophisticated global malware network.
Core Investigation
- Duration and Scope: Conducted between June 2008 and March 2009, the study used fieldwork, technical scouting, and laboratory analysis to uncover a network of at least 1,295 infected hosts across 103 countries.
- High-Value Targets: Nearly 30% of the compromised systems were high-value targets, including ministries of foreign affairs, embassies, international organizations (like ASEAN, SAARC, and NATO), news media, and NGOs.
- Tibetan Focus: The research began by investigating alleged Chinese cyber spying against Tibetan institutions, confirming that systems at the private office of the Dalai Lama and the Tibetan Government-in-Exile were conclusively compromised.
Technical Modus Operandi
- Infection Vector: Attackers used "social engineering," sending contextually relevant emails with malicious attachments (PDFs or Word docs) that exploited software vulnerabilities to install backdoors.
- Ghost RAT: Once infected, computers often downloaded a Trojan known as "ghost RAT" (Remote Access Tool), giving attackers complete, real-time control.
- Capabilities: The system allowed attackers to search and download files, log keystrokes, and covertly operate attached devices such as microphones and web cameras.
- Command and Control: Investigators discovered four web-based control servers (mostly located in China) that allowed attackers to manage the network and exfiltrate sensitive documents.
Key Conclusions
- Attribution Challenge: While circumstantial evidence—including IP addresses traced to Hainan Island—points toward Chinese actors, the report cautions against definitive attribution to the Chinese state.
- Rise of DIY Spying: The report highlights how low-cost, commercially available cybercrime kits allow non-state actors, criminal networks, or "patriotic hackers" to build effective global spynets.
- Strategic Impact: GhostNet serves as a "wake-up call" for the international community, demonstrating how technically unsophisticated methods can be harnessed to create a powerful and disruptive intelligence-gathering capability.
