The campaign is the second one targeted at oil companies to be discovered by SecureWorks this year. In February, researchers at the firm discovered attackers using remote access tools similar to Mirage to target several oil companies in Vietnam. That campaign also targeted government agencies in several countries, an embassy, a nuclear safety agency and multiple business groups, according to SecureWorks.
The domains for three of the command and control (C&C) servers used to control Mirage and for several of the C&C servers used in the February campaign, appear to belong to the same individual or group of individuals, SecureWorks said.
Also noteworthy is the fact that the IP addresses for the command and control servers used for Mirage and in the February campaign belong to China’s Beijing Province Network. The same network was also implicated in last year’s attacks on security vendor RSA that resulted in the theft of confidential information related to the company’s SecurID two-factor authentication technology.
A Canadian firm as well as a number of Asian companies are the targets – so far. This should be making you nervous. We appear to be in a cyber war already – and we are not really well prepared for that.