Covert Listening Threats even worse than recent hacking attempts

Over the past few weeks we have been researching data from various audits on the east coast. We are noting a large increase in the identification, location and disabling of covert listening devices. In the month of November alone we have discovered 14 separate listening devices at 7 different companies. One thing we also have noticed are some similarities between the various devices that have been located.

1. In several of the cases there were multiple listening devices in the same area. We believe this is being done so that if the primary is found the backup may continue to provide useful information to the attackers.

2. Fax machines are being heavily targeted at many businesses. We have been able to locate stolen documents in 4 of the cases out of the 14 being researched.

3. Ultrasonic devices are being used to avoid detection.

4. Networks are also being attacked with malware reporting back to 194.165.134.66. These IP's are also attempting to attack SMTP servers to verify accounts at these same organizations. This was determined through log file analysis.

5. 1 of the 14 companies is a major US Military Contractor.

These are the finding for November. We are still seeing covert listening devices in December and the numbers this month even with the holiday breaks are much higher than November so we are alerting companies to look for traffic to this host and call us if you have identified any. We would like to look for accompanying planted devices to see if this pattern remains. Only 1 of the 14 entities was not bugged or we did not locate any devices during the sweep.

SLC Security customers please read bulletin 2014-141 for additional information on the network IOC's and signal identification notations for these 14 locations.

COMPROMISED HOST: General Mills

We previously reported on General Mills. As of today we are still seeing indications of an infection coming from their network. We believe the host to be compromised.

Affected Host:
146.217.15.253
146.217.15.254

We have sent a notification for them to check their systems. We will update this post if we receive any follow up from them.

COMPROMISED HOST - University of Minnesota 128.101.165.206

We are starting to see reports of a compromised host out of the University of Minnesota. The IP address 128.101.165.206 looks to have been breached sometime around 11-26-2014 and as of 12-02-2014 was still showing infected although it has since dropped from our nightly analytic runs.

BOTNET Wall of Shame - This will be an ongoing feature of the blog

The following host were detected during our last review. These are the results out of the first 100 in the list. There are over 7600 in the full list. We will put these out there as we have time to review.

Of interest here is activity coming from DoD Network Information Center and DFN Systems. Most of the other records are the ISP and not the organization but we will post the raw information as our honeypot sensors pick up the traffic. 

11-14-2014,167.15.41.2,Munich Reinsurance America, Inc.
11-14-2014,67.222.114.236,Transwave Communications Systems, Inc. 
11-14-2014,216.117.191.22,Advanced Internet Technologies, Inc.
11-14-2014,162.243.234.167,Digital Ocean, Inc.
11-14-2014,38.84.134.199,PSINet, Inc.
11-14-2014,72.80.31.179,Verizon Online LLC
11-14-2014,199.87.232.185,eSited Solutions
11-14-2014,11.38.64.251,DoD Network Information Center
11-14-2014,204.152.209.74,QuadraNet, Inc
11-14-2014,23.19.39.19,Nobis Technology Group, LLC
11-14-2014,71.183.67.163,Verizon Online LLC
11-14-2014,74.116.128.15,DFN Systems
11-14-2014,162.219.179.101,Amanah Tech Inc.
11-14-2014,209.190.42.138,eNET Inc.
11-14-2014,54.68.211.27,Amazon Technologies Inc.
11-14-2014,50.63.35.1,GoDaddy.com, LLC
11-14-2014,192.210.53.49,Psychz Networks