A new report has outed a shadowy organisation called Hidden Lynx – a 100-strong group of expert hackers who are available for hire
LAST June, one of the world's most advanced hacker groups hit a problem. The US defence contractor whose systems it wanted to access only allowed a small set of trusted IP addresses to connect to their network. In an unusual move – hackers typically go for the low-hanging fruit – the group hacked the company that provided the IP whitelisting service, enabling it to forge access certificates.
This group, which calls itself Hidden Lynx, was given a vague face last week when antivirus software-maker Symantec released a report profiling it. Believed to be based in China, the group is known only through traces of malicious software bearing its mark found in the compromised computers of some of the world's largest companies.
Symantec estimates the group has 100 employees and says it has been operating for four years, specialising in attacks on financial and government institutions in the US. Chances are, the hackers will never be caught.
Steve Santorelli, a director of non-profit organisation Team Cymru – which monitors the internet's criminal underbelly – says Hidden Lynx is typical of what has become a gigantic cybercrime industry, with professional hacker groups raking in millions of dollars around the world.
Hidden Lynx and others are for hire, and while their expertise comes at a price, Santorelli says it's fairly easy to find them: "That's not because they overtly advertise, but because there is so much stuff on [online message board] Pastebin. Whether they'd give you the time of day is another question."
The group is a boutique hacker organisation, says Symantec analyst Gavin O'Gorman. It uses sophisticated signed malware that the antivirus firm has only seen on rare, linked occasions.
"Some of the technology they are using is breathtaking," says Santorelli. "They are bleeding edge computer scientists making serious amounts of money."
China makes a particularly good base for hacking groups, says criminologist Craig Webber of the University of Southampton in the UK, because Western law enforcement has practically zero influence there. "If you tell the Chinese authorities they have problems, they often turn around and say 'Is it affecting our citizens? If not then sorry, it's nothing to do with us'. "
Professional hacker groups are not restricted to illegal activities. O'Gorman points to Hacking Team, an Italian outfit which builds the commercial surveillance tool Da Vinci. "There are a couple of companies that will offer not quite a hacking service, but will offer trojans and exploits which they claim they will only sell to law enforcement," he says.
The rise of large professional hacking groups like Hidden Lynx combined with the development of such borderline products means the average person has greater access to carrying out sophisticated computer attacks than ever before, says O'Gorman. What's more, many of the sophisticated tools used by hackers have now leaked into underground marketplaces, where anyone can buy them, says Santorelli.
Professional hacking has reached a point where hacker high jinks are now looked down upon, he says. "There's a saying in these communities: no one makes any money if you break the internet."
This article appeared in print under the headline "Hackers for hire"
- New Scientist
- Not just a website!
- Subscribe to New Scientist and get:
- New Scientist magazine delivered every week
- Unlimited online access to articles from over 500 back issues
- Subscribe Now and Save
If you would like to reuse any content from New Scientist, either in print or online, please contact the syndication department first for permission. New Scientist does not own rights to photos, but there are a variety of licensing options available for use of articles and graphics we own the copyright to.
Have your say
Only subscribers may leave comments on this article. Please log in.
Only personal subscribers may leave comments on this article
All comments should respect the New Scientist House Rules. If you think a particular comment breaks these rules then please use the "Report" link in that comment to report it to us.
If you are having a technical problem posting a comment, please contact technical support.
