HeartBleed: The Advanced Persistent Threat

[PosterChild]

A friend of mine tells me that within hours of the public announcement of the HeartBleed vulnerability, his organization (a UART) came under attack by an ATP unit code-named UC. The ATP-UC attack was detected by their internal cyber security system and apparently was not able to establish a presence or "exfiltrate" any information.

Here is a detailed report on one particular ATP group - ATP1 - provided by Mandiant, a cyber security firm:

APT1: Exposing One of China's Cyber Espionage Units

This report is focused on the most prolific cyber espionage group Mandiant tracks: APT1. This single organization has conducted a cyber espionage campaign against a broad range of victims since at least 2006.

Their web site includes videos of actual ATP1 attacker and intrusion activities in progress!