Kaspersky: hackers for state-sponsored APT groups are recruited on closed forums

How groups look for developers

Members of APT groups — the organizers of sophisticated targeted cyberattacks — may engage third-party developers to create individual malware modules. Sergey Lozhkin told Gazeta.Ru, head of Kaspersky's Global Research and Analysis Team (Kaspersky GReAT) for the META and APAC regions.

Distributed development and closed platforms

According to the expert, work on malware can be distributed among several participants: one developer creates an individual module, which is then integrated into the overall attack infrastructure. The search for contractors is not conducted on open or semi-open forums, but on closed underground resources or through specific people familiar with developing complex cyberthreats. 'This is entirely possible — that is how the groups operate: they approach specific people on specific resources — underground forums and so on — and ask them to develop a module. Usually they know specific individuals,' Lozhkin explained.

Scale and context

APT attacks are most often used for espionage by state structures and are aimed at obtaining long-term access to organizations' systems; such operations require specialized tools and the involvement of several technical specialists. According to Lozhkin's estimate, there are several thousand people worldwide capable of developing highly complex malware. Earlier, at the end of October, Gazeta.Ru reported on cyberattacks by Chinese hackers against diplomatic institutions in Central Asia — the expert's new commentary explains how such operations can be staffed: a narrow circle of qualified developers allows groups to work through personal connections and closed platforms, bypassing open markets.