Has your company been infiltrated by the Shady Rat hack?

A security company has built a Web-based tool that checks your IP address against the Shady Rat server logs

When McAfee released its Operation Shady Rat hacking report earlier this week, it didn't name all of the organizations it thought could have been hacked as part of a large, five-year ongoing campaign. Yours might be one of them.

McAfee said 72 organizations worldwide were hacked, according log reports in a server that McAfee gained access to. It listed a few, such as the U.N., the U.S. International Trade Organization and the World Anti-Doping Agency, but most were unnamed.

The company's report generated wide media coverage and a breathless recount of the continued threat that sophisticated hackers pose. China even responded, saying in its official People's Daily newspaper on Friday that linking every cyberattack to the country is "irresponsible."

So how would a company find out if they were affected? It might be hard. But a security vendor has built a Web-based tool called the Shady Rat checker that went live on Friday. It checks to see if the IP address of the computer you are using is listed in the Shady Rat server logs.

A positive result means that a particular computer has communicated with the Shady Rat command-and-control server, said Aviv Raff, CTO and co-founder of Seculert, a company that has a cloud-based service used to detect malware and other cyberthreats.

"It means that your network is or was compromised by Shady Rat," Raff said. "It will also tell you how many times it communicated with the C&C server, and when was the first time."

After McAfee's Shady Rat report was released, Raff said "it took us few hours to put the clues together and realize which attack McAfee was referring to. This is only one of the attacks we monitor on a daily basis."

In fact, Raff said the Shady Rat attack is not particularly special, except for one technical aspect in how the command-and-control server transmitted instructions to compromised machines.

Even several days after McAfee released its report, the server is remarkably still online and communicating with infected machines. The log files are still openly available without any hacking, which is how Raff and Seculert were able to get a list of the 700 IP addresses. Raff said his organization learned the Shady Rat attack "several months ago," and McAfee said in its report that the attack was not new.

The Shady Rat server is hosted in the U.S. but Raff declined to reveal its hosting provider. "I'm sure they were already contacted, as this is under law enforcement investigation," he said.

Send news tips and comments to jeremy_kirk@idg.com

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags malwaredata protectionExploits / vulnerabilitiesSeculert

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?