Chinese attackers have apparently been utilizing PinkStats, an advanced persistent threat (APT) toolkit that is...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
notable for spreading via its own compromised network. Is there anything unique in the attack methods emphasized in PinkStats?
Ask the Expert!
SearchSecurity expert Nick Lewis is standing by to answer your questions about enterprise security threats. Submit your questions via email. (All questions are anonymous.)
PinkStats has reportedly been used over the past four years by a Chinese APT group that mainly targets South Korean-based networks. PinkStats is the downloader component of the toolkit these hacker groups are using to compromise and control computers in order to steal intellectual property, secrets and other valuable data.
For an APT attack to be successful, it would require more than the PinkStats downloader. First, an initial infection vector, which might include a zero-day exploit or a known exploit, must infiltrate the target system and only then can the downloader component download the rest of the malware used in the attack. Downloads commonly occur over encrypted custom protocols for the malware, standard HTTPS, peer-to-peer connections, and the like.
The only factor that differentiates the PinkStats downloader from other malware attacks is it uses HTTP to access what looks like a Web counter. However, after thorough analysis of the complete stream of communication between the compromised system and the command-and-control server, an analyst could identify that the communication was not just a Web counter, but rather a full-on malware attack. There are several other ways this malware could be detected. An antimalware network appliance could identify the malware by checking the external website against a blacklist of compromised websites. An appliance inspecting all downloaded files could examine the file in a sandbox to determine if any malicious actions are taken. Alternately, an endpoint security tool could accomplish either of these tasks.
Dig Deeper on Malware, Viruses, Trojans and Spyware
Related Q&A from Nick Lewis
A recent version of the iSpy keylogger has the ability to steal passwords and record Skype chats. Expert Nick Lewis explains how it works and how to ...continue reading
IoT botnet DDoS attacks have been growing in volume and impact. Expert Nick Lewis explains how you can ensure your internet-connected devices are ...continue reading
A new type of macro malware has the ability to evade the detection of virtual machines and sandbox environments. Expert Nick Lewis explains how to ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.