Hackers aren’t the only ones out there developing malware tools, but sometimes, they get their hands on some of the others. This is precisely what happened when Double Pulsar, a malware that the NSA has used in the past, was paired with a Chinese hacking tool and used to attack Hong Kong and Belgium in 2016.
Double Pulsar was, in essence, a tool that enabled a user to install programs (read: malware) on a targeted PC. The original version was only effective against 32-bit operating systems, but with the addition of the Chinese hacking tool, newer operating systems and 64-bit machines were suddenly vulnerable. Based on evidence that they have found, Symantec has formed a hypothesis that the tool was constructed after Chinese hackers analyzed the network traffic from an actual Double Pulsar attack.
Of course, this tool could have simply been stolen from an unsecured server. Regardless of where it came from, the precedent for tools being taken and warped into attack vectors is a dangerous one.
While the hacking group that utilized the Double Pulsar tool seems to no longer be active, this doesn’t mean that others can’t use it for their own ends. Having said that, the Chinese tool also leveraged a since-patched Windows vulnerability, which hopefully makes it a lame duck.
This is also far from the first time that NSA hacking tools have been co-opted by hackers. In 2017, a group known as the Shadow Brokers stole and shared a cache of hacking tools online...including the name Double Pulsar. This only goes to show that this threat isn’t new - and that proper network security is only that much more important. This is before we even consider the fact that state actors develop these kinds of tools very aggressively and take far more liberties than others.
What are your thoughts? Are you worried about state-sponsored tools being leveraged against your business? Discuss it in the comments, and don’t forget to reach out to us for assistance in securing your business’ network against threats like these. Give us a call at (760) 466-1200 to learn more about what we can do.
Comments