In today's video, we will explore the Chinese 'Double Dragon' hacking group,
also known as APT41. Welcome to the Darktrace YouTube channel. We are the world's leading
Cyber AI company and the pioneers of autonomous response technology. My name
is Brianna Leddy and I'm a Director of Analysis at Darktrace. Advanced Persistent Threats or APTs
are pretty much what they say on the tin. They're advanced, because they use sophisticated
methods to gain access to a system. They are persistent, because they are stealthy and can stay
undetected for a continuous period of time. And they are threats, because they have the potential
to cause lasting damage through stealing valuable data and disrupting operations.
Traditional cyber tools continuously fail to pick up on APT attacks, and governments and businesses
are starting to turn to artificial intelligence to protect against APTs. An APT attack can stay
in a system from half a year up to five years without being detected. How do they manage this?
Well, an APT attack occurs over five stages. The first is the Initial Infection, where the hacking
group gains access to a system through a variety of advanced methods, including zero-day exploits,
social engineering, spear phishing, and watering hole attacks. Then the hackers gain a foothold in
the company and establish the malware so they can spread across unnoticed. This is the third stage
where hackers dig deeper into the network and jump from one computer to another to escalate
their privilege and gain administrative power over the digital infrastructure. Then the hacking group
gathers intelligence about the system. This is called Internal Reconnaissance. They follow this
by moving laterally across the system to access different parts of the company. The APT group
now has complete control over the system. Now all they have to do is sit tight and try to gather as
much data as they can. APT hacking groups tend to stay in a system for as long as possible
so they can exfiltrate data over an extended period of time. This could be for either
political or economic reasons. So let's see this in practice, with one of the most prolific
and dangerous Advanced Persistent Threat actors out there - APT41. APT41, or Double Dragon,
is a Chinese state-sponsored group that has been active for over eight years. APT41 began
in 2012 by hacking video game companies and members. Since then, they have grown into a
massive state-sponsored operation, victimizing many industries in over 14 countries. In 2014,
APT 41 was running a profit driven and espionage campaigns side by side. For example, they tried
to deploy ransomware at a video game studio while attempting to steal data from a healthcare
target. These two cyber attacks, ransomware and data theft had different motivations,
and it's impressive and rare to see one threat actor doing both kinds at the same time. In 2015,
eight organizations and six different industries were compromised simultaneously, and since 2017,
Double Dragon have focused on supply chain compromises, such as when they compromised
CCleaner, with the result that poisoned copies of this popular utility were distributed to over 2
million users. That brings us to 2020. 2020 has been a busy year for APT41. They have targeted
over a hundred companies around the globe by exploiting vulnerabilities in CISCO routers,
Citrix and Zoho manage engine. In September, the US Department of Justice indicted five alleged
members of this hacking group. So why are APTs like Double Dragon so difficult to detect? Well,
most APTs are sponsored by nation states and this means that they have access to
extremely sophisticated tools and expertise. Basic cyber hygiene: things like firewalls,
multi-factor authentication, whitelists, regular patching, principle of least privilege - these are
all a good start, but they're not enough. Time and time again, we've seen that Advanced Persistent
Threats can get through legacy defenses, and that is why artificial intelligence is now so crucial.
AI technology has the ability to detect threats without relying on public Indicators of Compromise
or any prior knowledge. Instead, with its unique self-learning approach,
Darktrace can support strained security teams with AI-powered investigations and machine
speed responses. The 2020 cyber-attacks that we've discussed were publicly attributed to APT41
on March 25th. However, Darktrace's AI technology had detected these attacks two weeks previously.
If you want to know the secret of how Darktrace got so ahead of the curve, read our blog,
'Catching APT41' - the link is in the description below. To learn more about Darktrace Cyber AI,
please click on the links in the description to visit our website. If you have questions or would
like to know more, reach out to us over LinkedIn or Twitter or youtube@darktrace.com . Remember
to click on the subscribe button before you head out. Thank you, and see you next week!