The Australian Cyber Security Centre noted in its just-issued 2017 Threat Report that a small Australian defense company "with contracting links to national security projects" had been the victim of a cyber-espionage attack detected last November. "ACSC analysis confirmed that the adversary had sustained access to the network for an extended period of time and had stolen a significant amount of data," the ACSC report stated. "The adversary remained active on the network at the time."

More details of the breach were revealed on Wednesday at an IT conference in Sydney. ASD Incident Response Manager Mitchell Clarke said, "The compromise was extensive and extreme." The attacker behind the breach has been internally referred to at the Australian Signals Directorate as "APT Alf" (named for a character in Australia's long-running television show Home and Away, not the US television furry alien). Alf stole approximately 30 gigabytes of data, including data related to Australia's involvement in the F-35 Joint Strike Fighter program, as well as data on the P-8 Poseidon patrol plane, planned future Australian Navy ships, the C-130 Hercules cargo plane, and the Joint Direct Attack Munition (JDAM) bomb. The breach began in July of 2016.

A spokesperson for the US Department of Defense's F-35 Joint Program Office confirmed the breach to Defense News, stating that the Office "is aware" of the breach. The spokesperson reiterated that no classified data was exposed.

The ASD was alerted to the breach by a "partner organization" in November, Clarke said. When the ACSC's national Computer Emergency Response Team and ASD investigators arrived at the company, company representatives didn't believe they were real because they didn't carry official credentials.

Included in the data was a "wire diagram" of one of the Australian Navy's planned ships that provided a full layout of the ship's interior, Clarke said. "You could zoom in down to the captain's chair and see that it's, you know, 1 meter away from nav chair," Clarke explained.

Defence Industry Minister Christopher Pyne said in an interview with Australian Broadcasting Corporation radio on Thursday that none of the data stolen was classified, but it was commercially sensitive and restricted under International Traffic in Arms Regulations (ITAR). The attacker also had full access to company e-mails.

Easy access

The breach was achieved by "exploiting an Internet-facing server," the ACSC reported, "then [by] using administrative credentials to move laterally within the network, where they were able to install multiple webshells—a script that can be uploaded to a webserver to enable remote administration of the machine—throughout the network to gain and maintain further access."

The webshell used was "China Chopper," a remote Web access tool with variants based on Microsoft ASPX, Adobe Cold Fusion, and Java Server Pages. China Chopper, as its name indicates, has been used heavily in the past by Chinese hackers. Clarke said the attack may have been carried out by cybercriminals or a state actor. Australian officials have not made a specific attribution for the attack, and they have stated that they do not plan to share any additional details.

The initial penetration apparently did not require a great deal of effort, according to Clarke, who did not give the name of the company involved but did provide some additional details of the attack, as reported by ZDNet's Australian contributor Stilgherrian. The company had one full-time IT person on staff, and that person had only been working at the company for nine months. Clarke characterized the IT infrastructure at the company as "sloppy." The attackers used a 12-month-old known vulnerability to gain access to the company's IT Helpdesk Portal server—which was connected to file shares on an internal network server using the domain administrator's account.

"The attacker needn't have bothered with that, however," Stilgherrian reported. "The ASD's investigation found that internet-facing services still had their default passwords, admin::admin and guest::guest."