Russian government-backed hackers who penetrated high-profile U.S. government and defense industry computers this year used a method combining Twitter with data hidden in seemingly benign photographs, according to experts studying the campaign.
In a public report Wednesday, researchers at security company FireEye Inc said the group used the unusual tandem as a means of communicating with previously infected computers. FireEye has briefed law enforcement on what it found.
The technique, uncovered during a FireEye investigation at an unnamed victim organization, shows how government-backed hackers can shift tactics on the fly after they are discovered.
“It’s striking how many layers of obfuscation that the group adopts,” said FireEye Strategic Analysis Manager Jennifer Weedon. “These groups are innovating and becoming more creative.”
The machines were given an algorithm for checking a different Twitter account every day. If a human agent registered that account and tweeted a certain message, instructions for a series of actions by the computer would be activated.
The tweeted information included a website address, a number and a handful of letters. The computer would go to the website and look for a photo of at least the size indicated by the number, while the letters were part of a key for decoding the instructions in a message hidden within the data used to display the picture on the website.
Weedon said the communication method might have been a failsafe in case other channels were discovered and cut. Vikram Thakur, a senior manager at Symantec Corp , said his team had also found Twitter controls combined with hidden data in photos, a technique known as steganography.