Bit9: 32 Pieces of Malware Whitelisted In Targeted Hack

Bit9’s corporate network was compromised via a SQL injection that allowed attackers to access accounts and an inactive code-signing server; the attackers signed 32 malicious files (HiKit, HomeUNIX, Hydraq variants) and used them in watering-hole style attacks against three customer networks, effectively bypassing Bit9’s whitelisting defenses. Analysis points to sophisticated, information-gathering malware and possible attribution to actors in China/APAC, with evidence including C2 beacons and references to sinkholed IPs.