14 DAY TRIAL // People familiar with investigations into a recently disclosed industrial cyber espionage operation, claim that Exxon Mobil Corp., Royal Dutch Shell Plc and BP Plc were among the targeted companies.
Two weeks ago, McAfee published a white paper describing hacker attacks that siphoned sensitive data from the computers of global oil, energy and petrochemical companies.
The company dubbed the cyber espionage operation, which started in November 2009, Night Dragon, and said that evidence pointed to a Chinese origin.
McAfee didn't name any of the victims in its report, but according to Bloomberg, the names of Exxon, Shell and BP, as well as Marathon Oil Corp., ConocoPhillips and Baker Hughes, were revealed by people who worked on investigating the attacks.
The problem is that none of these companies reported the hacking incidents in filings with regulators, with drilling technology provider Baker Hughes claiming it wasn't "material to investors."
Furthermore, Bloomberg's sources said the attackers were after computerized topographical maps that showed the location of potential oil reserves.
The hackers used unsophisticated methods to gain access to computers, such as spear-phishing and remote administration tools. Despite this, it is believed that in some cases the security breaches went undetected for over a year.
This is not the first time when the names of Marathon Oil, Exxon Mobil and ConocoPhillips appear in an industrial cyber espionage report.
At the beginning of last year, the Christian Science Monitor reported that federal authorities contacted these companies in late 2008 and early 2009 to inform them that sensitive information was systematically stolen from their corporate networks.
In fact, the details of attacks described by the Christian Science Monitor and those of McAfee's Night Dragon operation overlap so well, that it would be easy to assume they are related. The 2008 - 2009 attacks also targeted exploration bid data and also involved spear phishing gainst employees in key positions.