IDG News Service — The strange e-mails arrived in executives' inboxes around the same time that the Australian oil company was negotiating a deal with a Chinese energy company.

The e-mails had the same structure and format as those sent around the company and were baited with text that appeared to refer to a supposed continuing discussion between executives. The messages looked authentic from a nontechnical perspective, just part of normal electronic communication within a company.

But the corporate IT administrator felt something wasn't quite right. Upon closer examination, the administrator found the e-mails, while appearing to come from internal company servers, were actually coming from other domains not authorized to send e-mail for the company.

The e-mails contained a malicious link that would redirect the person who opened it to a website of another energy company whose Web pages had been hacked in order to deliver malicious software designed to steal data. Victims would have no indication they'd been attacked.

It became clear that hackers were on a campaign to find out more about the pending deal.

"This was just their [the hackers] idea of due diligence," said the Australian IT administrator, who did not want himself or his company to be identified in this story due to the sensitivity of the intrusion.

The situation that faced the Australian company is one that is confronting companies and organizations worldwide regardless of their industry: hackers are getting a lot better at breaking through the defenses designed to keep information safe.

The attacks these days are "getting worse," said Alex Lanstein, a network and systems architect at security vendor FireEye, which makes systems designed to thwart Web-based attacks.

On Tuesday, McAfee -- a major security vendor now owned by Intel (INTC) -- said it had gained access to a server that had logged intrusions into 72 companies, nongovernmental organizations and governments, including the U.N., U.S. defense contractors and the World Anti-doping Agency, among many others.

Dubbed "Operation Shady RAT" (remote access tool), McAfee heralded the operation as one of the most significant examples of "advanced persistent threats," or cyberattacks that are undetected for a long time.

Some of the most frequently targeted organizations are financial institutions, energy companies, defense contractors and pharmaceutical companies, but hackers are also expanding their remit to other areas, such as law firms, Lanstein said.

Law firms are always at the core of many business transactions, ranging from mergers and acquisitions to patent negotiations and more. And their computer security practices are not quite as good as more frequently targeted organizations, Lanstein said.

Continue Reading