Hacker News Reader

Comment by an4rchy | Hacker News Reader

Not being sarcastic but sometimes it's about quality, not quantity.

Usually something this sophisticated is used to target specific individuals/organizations as they aren't generic botnet/bitcoin mining operations.

They might be after specific info and after they get it, they might even wipe their tracks as it's better to have a tool that nobody knows to look for than one that can get on as many computers as possible.

View on HN

Reminded me of this book I very much enjoyed about Stuxnet - "Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon". Stuxnet was a targeted attack directed at Iran's nuclear program. Quality, not quantity indeed. Super interesting to learn about these things!

Wasnt this attack triggered by scattering payloaded USBs around the facility, and someone plugged it in? lol

Stuxnet was highly targeted malware and certainly extremely sogisticated. That said, it infected probably >200,000 computer systems. To the parents point, it makes it easy to get a sample due to the volume of breaches. 100 targets with a highly covert mission objective is a different type of threat model compared to stux

Yeah, that bugs me a bit about this story. The (known) targets seem unimpressive for an attack tool this sophisticated. (Unless the targeted individuals were not just "individuals", but individuals who were prominent in certain organizations...)

> Unless the targeted individuals were not just "individuals", but individuals who were prominent in certain organizations...

I have to assume that's absolutely the case here. I didn't read this as "100 random individuals" being infected.

I didn't either. I read it as "activists", and on re-reading, I can't see where I got that. The actual targets could be a lot more important than that...

Yeah this kind of APT work seems like it would be targeted at high-value individuals, for either political or economic espionage..

So leaders of industry or government, etc..

If no known target thus far is high-profile, it could very well be that the current targets are guinea-pig-targets that test the malware for future applications.

Reply on news.ycombinator.com