Symantec: Well-heeled hacking group Black Vine behind Anthem breach

Black Vine has been active since 2012 and is behind several hacks targeting different industries

Victim of identity theft

Victim of identity theft

A group has been singled out as the attacker behind the recently disclosed hack against Anthem, believed to be the largest waged against a health care company.

It was Black Vine that broke into the health insurer's systems and stole more than 80 million patients records, Symantec said Tuesday in a report.

For Black Vine, it was the latest in a long line of hacks that began in 2012. Black Vine has gone after other businesses that deal with sensitive and critical data, including organizations in the aerospace, technology and finance industries, according to Symantec. The majority of the attacks (82 percent) were waged against U.S. businesses.

Black Vine has deep pockets, giving the group the resources to customize malware, and uses zero-day vulnerabilities in Microsoft Internet Explorer to launch watering-hole attacks. The IE exploits were used to install malware that gave Black Vine remote access to a victim's computer. To evade detection, Black Vine frequently updates its malware, according to Symantec.

The three modified malware strains Black Vine uses are Sakurel and Hurix, which are detected as Backdoor.Mivast, and Mivast, which is detected as Trojan.Sakurel.

Symantec claimed some Black Vine members have ties to Topsec, a Chinese IT security company, and the group has access to the Edlerwood framework, a platform for distributing new zero-day vulnerabilities. During its research, Symantec discovered Black Vine began using exploits around the same time as other hacking groups. Each group delivered different malware and went after certain organizations, but the fact that they used the same exploit suggests the attackers relied on the same distribution network.

One of the group's first attacks came in December 2012 against gas turbine manufacturer Capstone Turbine, Symantec said. That hack used the IE exploit CVE-2012-4792 and delivered the Sakurel malware. Symantec noted that the malware was signed with a digital certificate attributed to a company called Micro Digital, fooling Windows into believing the program was legitimate.

That same month, another unnamed turbine power manufacturer was attacked using Sakurel, leading Symantec to believe Black Vine was going after businesses in the energy industry.

In 2013 and 2014, Black Vine targeted companies in the aviation and aerospace industries. One third-party blog cited by Symantec noted that in 2013 specific employees at a global airline were sent spear phishing emails containing a URL that instructed them to download Hurix.

Black Vine compromised the website of a European aerospace company in 2014, accessing the company's domain and using it to attack the site's visitors. To carry out this attack, Black Vine used the IE vulnerability CVE-2014-0322 and installed an updated version of Sakurel on a victim's computer.

The Black Vine malware Mivast was used in the Anthem breach, according to Symantec. Anthem said the hack likely began in May 2014, but that it didn't realize its systems had been comprised until January. The company, which is one of the largest health insurance providers in the U.S., disclosed the breach in February. Hackers made off with personal data including names, birth dates, member ID numbers and Social Security numbers. Like the Capstone Turbine attack, the Mivast malware was signed with a fake digital certificate.

Symantec reckons spear phishing emails were used to deliver the malware since evidence of a watering hole attack wasn't reported. Anthem's IT staff was probably the attack's intended target, given that the malware was concealed as software related to technology like VPNs, said the security research company.

Anthem didn't immediately respond to a request for comment.

Fred O'Connor writes about IT careers and health IT for The IDG News Service. Follow Fred on Twitter at @fredjoconnor. Fred's e-mail address is fred_o'connor@idg.com

Join the CSO newsletter!

Error: Please check your email address.

Tags symantecsecurityhealth careindustry verticals

More about Capstone TurbineFredFred'sIDGMicrosoftNewsSymantecTwitter

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Fred O'Connor

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts

Market Place