Dell SecureWorks isn't naming this company, but in the "Chasing APT" paper Stewart points out that "companies found to engage in this kind of activity will likely have a difficult time maintaining trusted relationships with ethical security companies and security researchers who disavow such actions against civilian targets. This will make it harder for these companies to (legally) obtain real-time cyber threat intelligence, ultimately damaging both their reputation and their ability to defend their clients' networks from attacks."
In terms of its technical analysis of APTs, SecureWorks believes that along with the 200 unique families of custom malware used in cyber-espionage intrusions, there appear to be more than 1,100 domain names registered by cyber-espionage actors for use in hosting malware command-and-control or spear-phishing, and nearly 20,000 subdomains as well for purposes such as "malware C2 resolution."
But unlike other types of criminal botnets that "can contain millions of infected computers," cyber-espionage is far more focused, with "tens of thousands of infected computers spread across hundreds of botnets, each of which may only control a few to a few hundred computers at a time," the Dell SecureWorks report concludes.
Sign up for CIO Asia eNewsletters.