More than 100 companies, a quarter of them medical device firms, were the targets of a sophisticated hacking operation into their executives’ email accounts, according to cybersecurity firm FireEye.
(Reuters) — Security researchers say they have uncovered a cyber espionage ring focused on stealing corporate secrets for the purpose of gaming the stock market, in an operation that has compromised sensitive data about dozens of publicly held companies.
Cybersecurity firm FireEye, which disclosed the operation today, said that since the middle of last year, the group has attacked email accounts at more than 100 firms, most of them pharmaceutical and healthcare companies.
Although FireEye declined to identify any of the victims, it said 25% of the targeted companies were publicly traded medical device companies. Half of the targets were biotech firms, 10% were drug manufacturers and the rest a smattering of diagnostics companies, research groups, healthcare providers and healthcare planning providers, the group said.
Victims also include firms in other sectors, as well as corporate advisors including investment bankers, attorneys and investor relations firms, according to FireEye.
FireEye said it did not know whether any trades were actually made based on the stolen data.
Still, FireEye threat intelligence manager Jen Weedon said the hackers only targeted people with access to confidential insider data that could be used to profit on trades before the data was made public.
They sought data that included drafts of SEC filings, documents on merger activity, discussions of legal cases, board planning documents and medical research results, Weedon said.
“They are pursuing sensitive information that would give them privileged insight into stock market dynamics,” she said.
The victims ranged from small- to large-cap corporations. Most are in the United States and trade on the New York Stock Exchange or NASDAQ, she said.
FireEye said it notified all of the victims it discovered, as well as the FBI. An FBI spokesman declined comment.
The security firm designated the hacking group as FIN4 because it is #4 among the large, advanced financially motivated groups tracked by FireEye.
The hackers don’t infect the PCs of their victims. Instead they steal passwords to email accounts, then use them to access those accounts via the Internet, according to FireEye.
They expand their networks by posing as users of compromised accounts, sending phishing emails to associates, Weedon said.
FireEye said it hasn’t identified or located the hackers because they hide their tracks using Tor, a service for making the location of Internet users anonymous.
They are most likely based in the U.S. or Western Europe, based on the language they use in their phishing emails, Weedon said.
She said the firm is confident that FIN4 is not from China, based on the content of their phishing emails and their other techniques.
Researchers often look to China when assessing blame for economically motivated cyber espionage. The U.S. has accused the Chinese government of encouraging hackers to steal corporate secrets, allegations that Beijing has denied, causing tension between the countries.
Weedon suspects the hackers were trained at Western investment banks, giving them the know-how to identify their targets and draft convincing phishing emails.
“They are applying their knowledge of how the investment banking community works,” Weedon said.
