SoylentNews

janrinok writes:

A group of attackers with links to the Chinese hacking [sic] underground [itworld.com] has been targeting companies from the entertainment and video game industries for years with the goal of stealing source code. The stolen intellectual property is used to "crack" games so they can be used for free, to create game cheating tools or to develop competing products, security researchers from Dell SecureWorks said in an analysis of the group's activities.

Dell SecureWorks tracks the hacker group as Threat Group-3279 (TG-3279) and believes it has been active since at least 2009. Information gathered by the company's researchers while investigating compromises at affected firms suggests that the attack group uses a variety of tools for reconnaissance and persistent access on systems, some of which were developed by members of the group. These tools include an extensible remote access Trojan (RAT) program called Conpee and a rootkit called Etso for hiding network and file activity.

Other custom tools and scripts that can indicate a TG-3279 compromise, according to Dell SecureWorks, include: a system profiling tool called gsi.exe; a tool for loading PE (portable executable) files called Runxx; a SYN port scanner called "s;" a PHP SQL injection script called sqlin.php; a script for enumerating DNS entries called dnsenum.py; a RDP (remote desktop protocol) brute-force tool called rdp_crk; and a reverse shell for Windows systems called icmp_shell.

Original Submission