Hacker News Reader

Comment by PeterisP | Hacker News Reader

18000 customers downloaded the backdoored version so the attackers got access and could have gone into any and all of these networks. As far as we know, they did move forward in 250 or so and did not proceeed with the others (presumably because of resource constraints) - but still all those 18000 networks were infiltrated by the malware, and if I was one of these 18000 companies then I would not just assume that we got skipped - so at the very least that should result in 18000 careful audits to verify if the potential intrusion happened.

View on HN

The malicious version had items in place that would cause it to not activate if certain anti-malware software is present or other environmental conditions were not met (like not joined to an active directory). This reduces the number from 18k to something less (still probably huge) but 18k is the max if perfect conditions are present.

As for why the attackers did not proceed, resourcing probably had nothing to do with it and more along the lines of many of those customers were not interesting. Proceeding to load further malware stages in those uninteresting customers increases the chance of getting detected and given that the attacker was targeting long term persistent access to highly valuable targets, the attacker by design more likely simply left targets without valuable information alone.

It's probably both. Additional exploitation of targets was typically required to reach data of interest, and at a certain point you do get resource constrained having to deal with a high number of targets. It takes time to exploit them, it takes time to ingest and parse the discovered data, and even basic things like managing all the resulting shells takes time.

Based on this, as you say there were likely a high number of targets who probably were not worth the time to exploit, especially when every exploitation action increases the risk of detection and cessation of the op.

There was a 10~14 day time delay before it connected to its CNC. It minimized network traffic and was probably only activated for targets deemed worthy. People with a weapon like that don't want to be detected unless there is a viable target.

Reply on news.ycombinator.com