In February 2013, Twitter detected a hack attack in progress on its corporate network. "This attack was not the work of amateurs, and we do not believe it was an isolated incident," a Twitter official wrote when disclosing the intrusion. Sure enough, similar attacks were visited on Facebook, Apple, and Microsoft in the coming weeks. In all four cases, company employees were exposed to a zero-day Java exploit as they viewed a website for iOS developers.

Now, security researchers have uncovered dozens of other companies hit by the same attackers. Alternately known as Morpho and Wild Neutron, the group has been active since at least 2011, penetrating companies in the technology, pharmaceutical, investment, and healthcare industries, as well as law firms and firms involved in corporate mergers and acquisitions. The developers of the underlying surveillance malware have thoroughly documented their code with fluent English, and command and control servers are operated with almost flawless operational security. The take-away: the threat actors are likely an espionage group in a position to profit on insider information.

"Morpho is a skilled, persistent, and effective attack group which has been active since at least March 2012," researchers from security firm Symantec wrote in a report published Wednesday. "They are well resourced, using at least one or possibly two zero-day exploits. Their motivation is very likely to be financial gain and given that they have been active for at least three years, they must be successful at monetizing their operation."

Researchers from Kaspersky Lab, who released their own independent report, went further. They said the group has been active since at least 2011, and besides the Java zero-day from 2012, the attackers have recently started using a valid digital certificate issued to Acer Incorporated to get past code-signing requirements built into modern operating systems. They also detected the recent use of an "unknown Flash Player exploit, an indication the attackers may be using yet another zero-day exploit.

"The focus of these attacks suggests this is not a nation-state sponsored actor," Kaspersky Lab researchers wrote. "However, the use of zero days, multi platform malware as well as other techniques makes us believe it's a powerful entity engaged in espionage, possibly for economic reasons."

The reports from Symantec and Kaspersky Lab come a couple of weeks after Reuters reported US securities regulators are investigating a group of hackers suspected of breaking into corporate e-mail accounts to steal information they could trade on. The investigators with the Securities and Exchange Commission have asked at least eight companies for data on intrusions or attempted intrusions into their networks, including details on the tactics that the hackers used to trick employees into divulging passwords, the news organization said.

According to Symantec, at least 49 unique organizations have been infected with surveillance malware developed by the group. The OS X malware that infected Twitter and the other companies in 2013 was known as Pintsized. It provided a backdoor that allowed infected machines to establish encrypted connections with command and control servers so e-mail, corporate documents, and other confidential information could be obtained. Since that time the same OS X backdoor has been compiled for the Windows platform and continues to be used in more recent attacks.

Physical security systems targeted

In at least one case, attackers used the malware to access what is known as the physical security information management system, which is the software for aggregating, managing, and monitoring physical security systems and devices inside the targeted organization.

"The physical security systems could consist of CCTV, swipe card access, HVAC, and other building security," Symantec researchers wrote. "After compromis[ing] that system, the attackers could have monitored employees through the company's own CCTV systems and tracked the activities of individuals within the building."

It still remains unclear exactly how more recent attacks have managed to infect targeted computers. Whereas the attacks that hit Twitter and the other three companies in 2012 worked by boobytrapping iPhone developer forum iphonedevsdk.com, no such vector has been found in campaigns that have operated since then. The attackers have also been careful not to reuse e-mail addresses when registering command and control domains, and they use bitcoins to pay hosting providers. They also use multi-staged command and control networks with encrypted virtual machines to thwart forensics investigators.

Still, the existence of well-documented code is a good indication it's a small group of people, since a lone developer wouldn't likely go through the trouble.

"Compared to other APT groups, Wild Neutron is one of the most unusual ones we've analysed and tracked," Kaspersky Lab researchers wrote.