[37].pdf

In 2009, Google was attacked by a group using the Hydraq (Aurora) Trojan horse, and Symantec has monitored this group's activities for the last three years as they targeted various industries, including defense, human rights, and IT service providers. The attackers use zero-day exploits, supply chain attacks, and "watering hole" attacks, compromising websites likely to be visited by target organizations. They have used numerous zero-day exploits, including Adobe Flash Player and Microsoft Internet Explorer vulnerabilities, indicating access to high-level technical capability. The attacks are systematic, using the "Elderwood platform," and are deployed through spear phishing emails and web injections in watering hole attacks. The scale and resources required for these attacks suggest a large criminal organization, attackers supported by a nation-state, or a nation-state itself.