Anatomy of a Cyber-Espionage Attack

"Several years ago, information security analysts at a large U.S. firm noticed a huge amount of corporate network traffic headed to external servers. The data was destined for computers located in the U.S. and in foreign countries.

Reacting quickly, the analysts stanched the traffic flows but not before large amounts of corporate data had been stolen by unknown attackers.

Other large companies were also targeted during the same period. The attackers were able to process huge volumes of data, but they did so very selectively. They did not "take what they could get". They selected only specific files, a characteristic of highly professional attacks.

In addition, the attackers did not bother to view the files to verify their contents before "exfiltrating" them. This suggests that prior reconaissance missions had been conducted in which directory listings had been scrutinized beforehand and used to build a list of targets."

More Here....