The German drug manufacturer Bayer reported it was hit with
a cyberattack launched from China that used WINNTI malware that resided on its
network for at least one year.

The German drug manufacturer Bayer reported it was hit with
a cyberattack launched from China that used WINNTI malware that resided on its
network for at least one year.

The company told <a href="https://in.reuters.com/article/bayer-cyber/bayer-says-has-detected-contained-cyber-attack-idINKCN1RG0NF?rpc=401&amp;">Reuters</a>
it found the malware in its system in early 2018 and then studied and analyzed until
last month when it was removed. A Bayer spokesman told Reuters there is no evidence
of data was removed, but the company is still studying the overall impact the
malware had on its system.

The company told <a href="https://in.reuters.com/article/bayer-cyber/bayer-says-has-detected-contained-cyber-attack-idINKCN1RG0NF?rpc=401&amp;">Reuters</a>
it found the malware in its system in early 2018 and then studied and analyzed until
last month when it was removed. A Bayer spokesman told Reuters there is no evidence
of data was removed, but the company is still studying the overall impact the
malware had on its system.

The company is not exactly sure when the malware was injected.

The company is not exactly sure when the malware was injected.

Bayer’s internal cybersecurity team said the attackers used WINNTI
malware, a trojan associated with a <a href="https://www.cyber.nj.gov/threat-profiles/trojan-variants/winnti">Chinese
APT</a> group of the same name.

Bayer’s internal cybersecurity team said the attackers used WINNTI
malware, a trojan associated with a <a href="https://www.cyber.nj.gov/threat-profiles/trojan-variants/winnti">Chinese
APT</a> group of the same name.

The German drug manufacturer Bayer reported it was hit with
a cyberattack launched from China that used WINNTI malware that resided on its
network for at least one year.



The company told <a href="https://in.reuters.com/article/bayer-cyber/bayer-says-has-detected-contained-cyber-attack-idINKCN1RG0NF?rpc=401&amp;">Reuters</a>
it found the malware in its system in early 2018 and then studied and analyzed until
last month when it was removed. A Bayer spokesman told Reuters there is no evidence
of data was removed, but the company is still studying the overall impact the
malware had on its system.



The company is not exactly sure when the malware was injected. 



Bayer’s internal cybersecurity team said the attackers used WINNTI
malware, a trojan associated with a <a href="https://www.cyber.nj.gov/threat-profiles/trojan-variants/winnti">Chinese
APT</a> group of the same name.

winnti6.jpg

Threats

Cyberespionage

Malware

News

Pharma firm Bayer hit with WINNTI malware

Related Events

Earn up to 1.5 CPE credits by attending this virtual event.



Malware analysis is an increasingly important tool in an organization’s incident-management toolkit — enabling it to determine the source and potential impact of an intercepted virus, worm or trojan. Malware analysis can also help a target company assess damage and data loss, respond accordingly, and reset defenses going forward.



SC Media&#8217;s half-day virtual event will help bring you up to speed on a capability of increasing relevance to companies across a broad range of sizes and sectors. Key discussion and presentation topics include:



<ul><li>Proven tools and methodologies that detect and mitigate malware attacks</li><li>Establishing a malware analysis capability that suits your organization</li><li>A look over the horizon at tomorrow’s malware threats</li></ul>



To determine if malware analysis has place in your security plan, register now.



<hr class="wp-block-separator"/>



FEATURED SPEAKER



<figure class="wp-block-image size-full is-resized"><img src="https://files.scmagazine.com/wp-content/uploads/2021/09/Malware-Speaker-for-WordPress-02-2.png" alt="" class="wp-image-198343" width="248" height="285" srcset="https://files.scmagazine.com/wp-content/uploads/2021/09/Malware-Speaker-for-WordPress-02-2.png 412w, https://files.scmagazine.com/wp-content/uploads/2021/09/Malware-Speaker-for-WordPress-02-2-261x300.png 261w" sizes="(max-width: 248px) 100vw, 248px" /></figure>



<div style="height:27px" aria-hidden="true" class="wp-block-spacer"></div>



AGENDA



<hr class="wp-block-separator"/>



11:00 AM ET KEYNOTE | This is not your grandfather&#8217;s malware: How to adapt your defenses Nemi George, Vice President&nbsp;of IT, Information Security &amp; IT Operations, Pacific Dental Services



By most accounts, malware dates back to before the internet – with file infectors spread via floppy disk. So why does it remain so prevalent? Nemi George, vice president of IT, information security &amp; IT operations at Pacific Dental Services, will dig into the evolution of malware, how increases in sophistication have outpaced most defense strategies, and why the typical approach of protecting the endpoints no longer cuts it for preventing&nbsp;infiltration&nbsp;of the network.&nbsp;



11:30 AM ET Visit exhibit hall



11:40 AM ET Walking the DarkSide: Malware analysis and beyond Andrew Costis,&nbsp;Senior Cyber Threat Consultant&nbsp;&#8211;&nbsp;EMEA,&nbsp;AttackIQ



New and emerging threats in the form of malware are prolific in our industry today. Malware analysis is a great skill for threat researchers, SOC analysts and incident responders to possess. While malware analysis is viewed by many to be a specialized area for an elite minority, malware analysis doesn&#8217;t have to be difficult, costly or time intensive. Malware analysis is highly advantageous and can aid with purple teaming, continuous security control validation and ultimately improve your overall security and defensive capabilities within your&nbsp;organization&nbsp;and beyond.&nbsp;&nbsp;&nbsp;



Attend this session to learn:&nbsp;&nbsp;



<ul><li>The who, what,&nbsp;where,&nbsp;when and why of malware analysis&nbsp;</li><li>A walk through the recent&nbsp;DarkSide&nbsp;ransomware that impacted the Colonial Pipeline&nbsp;&nbsp;</li><li>How malware analysis can drive collaboration to adopt a purple teaming strategy&nbsp;</li><li>How malware analysis can drive continuous security control validation and beyond</li></ul>



12:10 PM ET Visit exhibit hall



12:20 PM ET Preparing for the next generation of ransomware attacks&nbsp; JJ Cranford,&nbsp;Director – Product Marketing,&nbsp;Cybereason&nbsp;



Ransomware has continued to prove itself as an extremely lucrative option for cyber adversaries, making it a top concern for most information security teams. The sophistication of ransomware has increased, while the bar&nbsp;has been simultaneously lowered for bad actors to deploy and operate successful attacks.&nbsp;



Join this session to hear more about:&nbsp;



<ul><li>The anatomy of a modern ransomware attack from initial foothold to encryption of sensitive data&nbsp;</li><li>The connection between the HAFNIUM attack on Microsoft Exchange servers and modern ransomware tactics&nbsp;</li><li>How Cybereason technology can fully prevent, detect and remediate sophisticated ransomware operations&nbsp;</li></ul>



<div style="height:98px" aria-hidden="true" class="wp-block-spacer"></div>

Generic_215x132_bannerNEW4

Threat intelligence

Incident response

Forensics

Cloud

Security awareness

Network security

Application security

eSummit

Malware Analysis: Taking incident management to the next level

Earn up to 3 CPE credits by attending this virtual conference.



Through advanced techniques and a specific focus, cybercriminals — including nation-state actors – seek to gain access to heavily defended environments. Responding to these attacks as they happen is extremely difficult, which is why it’s essential to invest in and sharpen your incident detection and response strategy before an attack happens. SC Media hosted a virtual event on August 10 that convened keynote speakers John Grim of Verizon Threat Research Advisory Center and Keatron Evans of InfoSec who specialize in combatting state-sponsored attackers. Discussions and presentations provided insight on how to detect and prevent such threats, including:



<ul><li>Understand who the threat actors are and the tactics, techniques and procedures they use</li><li>Learn what can be done to prevent, mitigate, detect and respond to these attacks</li><li>Hear from leading incident detection and response vendors about their offerings and strategies</li></ul>



Our Advanced Incident Detection curriculum will give you the perspective you need to position your defenses. Register for the On-Demand eSummit now!



<hr class="wp-block-separator is-style-wide"/>



AGENDA



10:45 AM ET&nbsp; Conference opens&nbsp; &nbsp; 11:00 AM ET&nbsp; KEYNOTE |&nbsp;Cyber-espionage threat landscape&nbsp; John Grim,&nbsp;Head of Research, Development, and Innovation at Verizon Threat Research Advisory Center&nbsp;



Cyber-espionage breaches pose a unique challenge. Through advanced techniques and a specific focus, cyber-espionage threat actors seek to gain access to heavily defended environments, laterally move with stealth, efficiently obtain targeted data and move out smartly (or even stay back and maintain covert persistence).&nbsp;&nbsp;



To shed some light on the state of cyber espionage, Verizon released its 2020-2021 Cyber-Espionage Report. This keynote features insights from the report to identify:&nbsp;&nbsp;



<ul><li>Targeted victims and the attributes, assets and data that are&nbsp;targeted&nbsp;</li><li>Who the threat actors are and the tactics, techniques and procedures they&nbsp;use&nbsp;&nbsp;</li><li>What can be done to prevent, mitigate, detect and respond to their attacks&nbsp;</li></ul>



11:55&nbsp;AM&nbsp;ET&nbsp;&nbsp; Effectively detect and respond to APT intrusions&nbsp; Lindsay Kaye,&nbsp;Director of Operational Outcomes for&nbsp;Insikt&nbsp;Group,&nbsp;Recorded Future&nbsp; Craig Terron,&nbsp;Sr. Manager of&nbsp;Insikt&nbsp;Group’s Global Issues Team, Recorded Future&nbsp;&nbsp;



By their nature, APT campaigns are stealthy and hard to detect. Without an understanding of the tactics and techniques used by these threat actors, you will&nbsp;be stuck in the dark when it comes to defending against an attack.&nbsp;



Join Recorded Future for a lively discussion about APT detection strategies and:&nbsp;



<ul><li>Learn how you can implement procedures to efficiently observe activity&nbsp;</li><li>Detect intrusions and respond&nbsp;</li><li>Strengthen your security posture&nbsp;</li></ul>



12:35&nbsp;PM ET&nbsp;&nbsp; The importance of embedded expertise to help guide incident response&nbsp; Eoin Miller,&nbsp;Manager&nbsp;of&nbsp;Detection and Response Services, Rapid7&nbsp;



During a response to an incident, the organization’s leaders can be confronted with several time-critical decisions. To maintain its reputation and the trust of its customers, as well as minimize the financial impact, leaders must ensure they are making informed decisions. To get these decisions right the first time, the importance of embedded expertise cannot be stressed enough.&nbsp;



Join Rapid7 at this session to learn:&nbsp;



<ul><li>Strategies to tackle deeply technical issues of what an attacker has done and had access to&nbsp;</li><li>How the organization’s actions could impact the business and customers&nbsp;</li><li>The common types of expertise that could be obtained from within the organization and from outside firms, if necessary&nbsp;</li></ul>



&nbsp; 1:15&nbsp;PM ET&nbsp; Tales from the frontlines of nation-state attacks&nbsp; Dr. Saumitra Das, CTO Founder, Blue Hexagon&nbsp;



In just Q1 of 2021, there were already more than 20 documented high impact state-sponsored attacks. These state-sponsored attackers have great operational security, are willing to lie low patiently and persist to find the victim’s crown jewels versus smashing and grabbing, and they are increasingly utilizing the software supply chain and even the security supply chain and even the security supply chain to gain initial access.&nbsp;



This webcast covers key tactics being used by state-sponsored attackers in targeted&nbsp;intrusions&nbsp;with real battlefield examples including software supply chain infection, security supply chain exploits, evasive C2 and beaconing, AI and automation for malicious targeting and code generation, and lateral spread between on-premises to cloud to mobile.&nbsp;



Understanding these tactics provides a framework for reasoning about the most effective countermeasures. To deal with a sophisticated adversary, a multipronged approach is needed for defense that includes:&nbsp;



<ul><li>Focusing on detection and response of the unknown versus rules-based prevention&nbsp;</li><li>Supercharging security staff with tools that have an opinion versus just visualizing a ton of log data&nbsp;</li><li>Reducing attack surface proactively&nbsp;</li></ul>



1:55&nbsp;PM ET&nbsp; KEYNOTE |&nbsp;Tales from the SOC: Lessons any cyber team can learn from&nbsp; Keatron&nbsp;Evans,&nbsp;Principal Security Researcher,&nbsp;InfoSec&nbsp;



While the security&nbsp;threatscape&nbsp;evolves every day, attacker tactics and techniques are often more predictable than creative. Join veteran incident responder and cybersecurity instructor&nbsp;Keatron&nbsp;Evans for first-hand accounts of the most challenging responses of his career — and what he and his clients learned along the way. You’ll leave this session with practical steps your SOC team can take now to prepare for the next attack, including how to:&nbsp;&nbsp;



<ul><li>Assess your team’s skills&nbsp;</li><li>Patch knowledge gaps to build defenses for tomorrow’s threats</li></ul>

Ransomware

SIEM

Advanced Incident Detection: Protecting your business from state-sponsored actors

Many — perhaps most — security professionals do not build their threat models around cyberespionage, but that approach is changing. Mapping the kill chain — understanding each stage of an attack from early reconnaissance to data removal — is increasingly an essential starting point. Yes, state-sponsored hackers tend to go after bigger fish, but hackers-for-hire are leveraging the same tactics once used by government-backed forces to target smaller companies — especially as more small organizations increase the reach of their digital operations. In other contexts, bad actors treat small and mid-sized companies as points-of-access to get to larger targets they may do business with.



Join CyberRisk Alliance for a two-day virtual conference, Jan. 26-27, in which we’ll bring together some of the most innovative thinkers in threat detection and incident response, endpoint security, and more, as they unpack the practical implications of adversary intelligence, including:



<ul><li>The cyberattack methods hackers are using today.</li><li>The cybersecurity data that should influence your 2021 planning.</li><li>Defense strategies and techniques to overcome ransomware.</li></ul>



Designed for organizations of all sizes, this virtual conference provides comprehensive perspective on why and how to enhance your defenses by adopting a more proactive stance. Register now.



<hr class="wp-block-separator"/>







<div class="wp-block-image"><figure class="aligncenter size-medium"><a href="https://www.sophos.com/"><img width="300" height="50" src="https://staging.scmagazine.com/wp-content/uploads/sites/2/2020/10/sophos-300x50.png" alt="Sophos" class="wp-image-110833" srcset="https://files.scmagazine.com/wp-content/uploads/2020/10/sophos-300x50.png 300w, https://files.scmagazine.com/wp-content/uploads/2020/10/sophos-1024x169.png 1024w, https://files.scmagazine.com/wp-content/uploads/2020/10/sophos-768x127.png 768w, https://files.scmagazine.com/wp-content/uploads/2020/10/sophos-860x142.png 860w, https://files.scmagazine.com/wp-content/uploads/2020/10/sophos-156x26.png 156w, https://files.scmagazine.com/wp-content/uploads/2020/10/sophos-312x52.png 312w, https://files.scmagazine.com/wp-content/uploads/2020/10/sophos-640x106.png 640w, https://files.scmagazine.com/wp-content/uploads/2020/10/sophos.png 1192w" sizes="(max-width: 300px) 100vw, 300px" /></a></figure></div>



<div class="wp-block-image"><figure class="aligncenter size-medium"><img width="300" height="32" src="https://staging.scmagazine.com/wp-content/uploads/sites/2/2020/10/AttackIQ_Logo__2_-300x32.png" alt="AttackIQ Logo" class="wp-image-111131" srcset="https://files.scmagazine.com/wp-content/uploads/2020/10/AttackIQ_Logo__2_-300x32.png 300w, https://files.scmagazine.com/wp-content/uploads/2020/10/AttackIQ_Logo__2_-1024x109.png 1024w, https://files.scmagazine.com/wp-content/uploads/2020/10/AttackIQ_Logo__2_-768x81.png 768w, https://files.scmagazine.com/wp-content/uploads/2020/10/AttackIQ_Logo__2_-860x91.png 860w, https://files.scmagazine.com/wp-content/uploads/2020/10/AttackIQ_Logo__2_-156x17.png 156w, https://files.scmagazine.com/wp-content/uploads/2020/10/AttackIQ_Logo__2_-312x33.png 312w, https://files.scmagazine.com/wp-content/uploads/2020/10/AttackIQ_Logo__2_-640x68.png 640w, https://files.scmagazine.com/wp-content/uploads/2020/10/AttackIQ_Logo__2_.png 1198w" sizes="(max-width: 300px) 100vw, 300px" /></figure></div>



<div class="wp-block-image"><figure class="aligncenter size-full"><a href="https://www.recordedfuture.com/"><img src="https://staging.scmagazine.com/wp-content/uploads/sites/2/2020/10/recordedfuture.png" alt="" class="wp-image-107708"/></a></figure></div>



<div class="wp-block-image"><figure class="aligncenter size-medium"><a href="https://www.vmware.com/"><img width="300" height="46" src="https://staging.scmagazine.com/wp-content/uploads/sites/2/2020/11/VMware-Logo-200x200-01-1024x1024-1-300x46.png" alt="" class="wp-image-109472" srcset="https://files.scmagazine.com/wp-content/uploads/2020/11/VMware-Logo-200x200-01-1024x1024-1-300x46.png 300w, https://files.scmagazine.com/wp-content/uploads/2020/11/VMware-Logo-200x200-01-1024x1024-1-768x118.png 768w, https://files.scmagazine.com/wp-content/uploads/2020/11/VMware-Logo-200x200-01-1024x1024-1-860x132.png 860w, https://files.scmagazine.com/wp-content/uploads/2020/11/VMware-Logo-200x200-01-1024x1024-1-156x24.png 156w, https://files.scmagazine.com/wp-content/uploads/2020/11/VMware-Logo-200x200-01-1024x1024-1-312x48.png 312w, https://files.scmagazine.com/wp-content/uploads/2020/11/VMware-Logo-200x200-01-1024x1024-1-640x98.png 640w, https://files.scmagazine.com/wp-content/uploads/2020/11/VMware-Logo-200x200-01-1024x1024-1.png 995w" sizes="(max-width: 300px) 100vw, 300px" /></a></figure></div>



<div class="wp-block-image"><figure class="aligncenter size-medium"><a href="https://www.knowbe4.com/"><img width="300" height="83" src="https://staging.scmagazine.com/wp-content/uploads/sites/2/2020/10/knowbe4-300x83.png" alt="KnowBe4 Logo" class="wp-image-111163" srcset="https://files.scmagazine.com/wp-content/uploads/2020/10/knowbe4-300x83.png 300w, https://files.scmagazine.com/wp-content/uploads/2020/10/knowbe4-156x43.png 156w, https://files.scmagazine.com/wp-content/uploads/2020/10/knowbe4-312x87.png 312w, https://files.scmagazine.com/wp-content/uploads/2020/10/knowbe4.png 367w" sizes="(max-width: 300px) 100vw, 300px" /></a></figure></div>



<div class="wp-block-image"><figure class="aligncenter size-large is-resized"><img src="https://staging.scmagazine.com/wp-content/uploads/sites/2/2021/01/eclypsumlogo_highres-edited.jpg" alt="" class="wp-image-111321" width="197" height="147" srcset="https://files.scmagazine.com/wp-content/uploads/2021/01/eclypsumlogo_highres-edited.jpg 683w, https://files.scmagazine.com/wp-content/uploads/2021/01/eclypsumlogo_highres-edited-300x225.jpg 300w, https://files.scmagazine.com/wp-content/uploads/2021/01/eclypsumlogo_highres-edited-640x480.jpg 640w, https://files.scmagazine.com/wp-content/uploads/2021/01/eclypsumlogo_highres-edited-156x117.jpg 156w, https://files.scmagazine.com/wp-content/uploads/2021/01/eclypsumlogo_highres-edited-312x234.jpg 312w" sizes="(max-width: 197px) 100vw, 197px" /></figure></div>



<div class="wp-block-image"><figure class="aligncenter size-medium"><a href="https://www.area1security.com/"><img width="300" height="80" src="https://staging.scmagazine.com/wp-content/uploads/sites/2/2020/10/Area1_logo_color__2_-300x80.png" alt="Area 1 Security Logo" class="wp-image-111164" srcset="https://files.scmagazine.com/wp-content/uploads/2020/10/Area1_logo_color__2_-300x80.png 300w, https://files.scmagazine.com/wp-content/uploads/2020/10/Area1_logo_color__2_-1024x272.png 1024w, https://files.scmagazine.com/wp-content/uploads/2020/10/Area1_logo_color__2_-768x204.png 768w, https://files.scmagazine.com/wp-content/uploads/2020/10/Area1_logo_color__2_-1280x344.png 1280w, https://files.scmagazine.com/wp-content/uploads/2020/10/Area1_logo_color__2_-860x228.png 860w, https://files.scmagazine.com/wp-content/uploads/2020/10/Area1_logo_color__2_-156x41.png 156w, https://files.scmagazine.com/wp-content/uploads/2020/10/Area1_logo_color__2_-312x83.png 312w, https://files.scmagazine.com/wp-content/uploads/2020/10/Area1_logo_color__2_-640x170.png 640w, https://files.scmagazine.com/wp-content/uploads/2020/10/Area1_logo_color__2_.png 1296w" sizes="(max-width: 300px) 100vw, 300px" /></a></figure></div>

Pharma firm Bayer hit with WINNTI malware

Related

NSA’s Cybersecurity Collaboration Center marks a shift in spy agency’s public profile

‘SolarWinds is just part of the story’: Winnti threat group abusing trust since 2009

US, Australia and UK warn Iranian hackers leveraging known vulnerabilities to deploy ransomware

Related Events

Malware Analysis: Taking incident management to the next level

Advanced Incident Detection: Protecting your business from state-sponsored actors

Knowing your adversary: Mapping cyber kill chain indicators to security tactics