Botnet that hid for 18 months(arstechnica.com) |
Botnet that hid for 18 months(arstechnica.com) |
> In this blog post, we introduce UNC3524, a newly discovered suspected espionage threat actor that, to date, heavily targets the emails of employees that focus on corporate development, mergers and acquisitions, and large corporate transactions. On the surface, their targeting of individuals involved in corporate transactions suggests a financial motivation; however, their ability to remain undetected for an order of magnitude longer than the average dwell time of 21 days in 2021, as reported in M-Trends 2022, suggests an espionage mandate.
Is there enough money in high finance to support the development of sophisticated tools to rig trading markets?
Yes, but a well timed economic WMD on countries heavily reliant on efficient capital markets would greatly distract them from interfering in international events.
Or are these people going on r/wallstreetbets to write long DD upvoted by bots, purchased accounts, awards, under VPN to make their purchases seem organic?
Still wouldn't it be obvious somebody doing that routinely and establishing a pattern of unusually high win rates before earnings?
Sort of like how poker companies catch cheaters, simply by knowing the average win rate to be within a specific distribution, even the slightest deviation or outlier would send its risk management scrutinizing play by play to determine a pattern.
Wouldn't large state actors with web of shell companies be able to obfuscate and get away with impunity? Literally printing money and also weaponizing a foreign financial market.
"59 members of Congress have violated a law designed to stop insider trading and prevent conflicts-of-interest"
https://www.businessinsider.com/congress-stock-act-violation...
That's the most effectively hidden malware code I know of.
https://arstechnica.com/information-technology/2013/03/the-w...
Other modules in Gauss monitored transactions with Lebanese banks, so a logical assumption is it was deployed as part of a terror financing investigation against a very specific set of computers.
Is there any information about their targets?
But what would likely have helped is a focus on strong controls around identity and access management. Especially in the form of passwordless auth. Would certainly make lateral moves harder.
There isn't much info to go on, but it almost sounds like they were after the type of financial data that would be useful for insider trading.