Security researchers have often made the mistake of assuming that when a specific tool was observed
being used in espionage attacks, it was representative of activity of a single actor. More frequently,
however, many are now identifying that distinct groups of attackers are sharing their toolsets, just as in the cybercrime world.
One such toolset, the ScanBox framework, is now shared between a number of groups who conduct
espionage attacks. Evidence suggests that these groups include those behind the recent Forbes and
Anthem attacks. This short paper outlines our current perspectives on the previously discussed espionage groups currently using the framework and a hint that a 5th player is getting in on the game.
more here..........http://pwc.blogs.com/files/cto-tib-20150223-01a.pdf
being used in espionage attacks, it was representative of activity of a single actor. More frequently,
however, many are now identifying that distinct groups of attackers are sharing their toolsets, just as in the cybercrime world.
One such toolset, the ScanBox framework, is now shared between a number of groups who conduct
espionage attacks. Evidence suggests that these groups include those behind the recent Forbes and
Anthem attacks. This short paper outlines our current perspectives on the previously discussed espionage groups currently using the framework and a hint that a 5th player is getting in on the game.
more here..........http://pwc.blogs.com/files/cto-tib-20150223-01a.pdf