Researchers at Kaspersky have identified a mysterious group of hackers that could be cyber-mercenaries, rival drug dealers or even law enforcement

Researchers have been left a little baffled by a highly-sophisticated hacker crew that is simultaneously stealing data from drug dealers and government entities.



Named 'MiniDuke' after the malware the group uses, the attackers initially appeared to have been backed by a nation state, as a range of government agencies and research institutes from across the globe had been targeted, according to research released in February 2013.



But an anomaly arrived in the logs of Kaspersky Labs researchers in recent months which indicated that individuals involved in drug deals had been affected by the MiniDuke hackers.

After tracking one of the command and control servers used by the attackers, they were led to a site dispensing illegal substances, including certain kinds of steroids and hormones, though Vitaly Kamluk, principal security researcher at Kaspersky, would not say which.



This finding led Kamluk and his colleagues to a number of guesses as to the nature of MiniDuke. The crew could be “cyber mercenaries”, consisting of several subdivisions, selling their services to different groups, possibly law enforcement or a competing criminal group that wanted to track a rival drug dealer, as well as government clients.



Whoever they are, they have old-school hacking skills and a high degree of technicality, tweaking encryption standards to make tracking them that much harder, the researcher added. “They are more like underground cyber criminals than a typical nation state. This is what makes them stand out,” Kamluk said.



Yet the main targets in 2014 remain government bodies. Kamluk said the group was seen using open source hacking tools to scan the internet for useful information on potential victims in Ukraine, Azerbaijan and Greece.



“They were collecting everything like emails, names, nicknames and handles,” he told the Guardian.



The time stamps on their operations, showing what hours they were active, indicated they were operating out of Eastern Europe or Asia, Kamluk said. As Cyrillic characters were used in the code, the former is more likely.



The MiniDuke crew has also released a fresh kind of malware into the world, called CosmicDuke, that spoofs popular applications,such as Chrome and Java updaters. Just like the team’s other malware, it can steal a range of data from MP3s to Word documents to passwords and logins.



Some of CosmicDuke’s code was also found in a highly-sophisticated malware type called Uroboros, believed to have come out of Russia.



The malware creators have created a tonne of Twitter profiles too, which link to domains used to control the malicious toolkits, so even if their command and control servers were compromised by law enforcement, the group would still have access to infected machines.



It is believed MiniDuke has claimed at least 139 victims since it started operating, with 14 in the UK. Most targets were in Georgia with 84, followed by Russia on 61 and the US on 34.

• UK forges close cyber ties with China despite ‘endemic espionage’

• Chinese military group linked to hacks of US and European satellite companies