Security researchers have discovered a new cyber espionage campaign targeting several large companies, including two in the energy sector.

The campaign, dubbed Mirage, targeted an oil company in the Philippines, an energy firm in Canada, a military organisation in Taiwan and other unidentified targets in Brazil, Israel, Egypt and Nigeria. 

This is the second cyber espionage campaign to be uncovered this year by the Counter Threat Unit (CTU) of security firm Dell SecureWorks.

The first campaign, dubbed Sin Digoo, targeted several petroleum companies in Vietnam, government ministries in different countries, an embassy, a nuclear safety agency and other business related groups.

The researchers believe that either the same group is behind both campaigns, or that whoever is responsible for Mirage is working closely with those behind Sin Digoo.

Three Command and Control domain names in the Mirage campaign are owned by someone using the same email addresses as the owner of several C&C domains used in the Sin Digoo campaign.

The C&C IP addresses belong to the China Beijing Province Network (AS4808), said researchers, which is known for many other connections to malware and espionage.

The researchers said the Mirage malware avoids detection by disguising its C&C communications as Google Searches by using SSL communications and a similar URL pattern to that of a Google Search.

According to testing site Virus Total, only half of the major anti-virus scanners detected Mirage.

The victims of the Mirage campaign are being infected by spearphishing emails containing a malicious executable. Clicking on the attachment drops a pdf, along with the executable.

One of the spearphishing emails used in this campaign contained a pdf of a news story titled “Yemeni Women can participate in politics just like men, says President Saleh.”

Energy companies, along with pharmaceutical and high-tech industries are the most common targets of these advanced persistent threat campaigns, said Don Smith, technology director at Dell SecureWorks.

“But we are seeing other industries now being targeted, and all businesses should ask themselves just how confident they are that their cyber security regime minimises the risks of attack, but I would say very few in my experience,” he told the Gartner Security & Risk Management Summit 2012 in London.

Researchers at Dell SecureWorks have identified more than 580 separate families of malware what are related to targeted advanced persistent attacks.

In the face of this new breed of attacks, where “anything is possible”, Smith said organisations should ensure they had a layered approach to security.

“There is no silver bullet to deal with these attacks which is why businesses need to have protections at all levels,” he said.

Organisations need to understand the threat landscape, who is likely to attack them and why, said Smith, so they can prepare accordingly.

Where possible, he said, this should include a forensic capability so that in the event of an attack, an organisation can identify exactly what went wrong.

“Information security professionals must talk to the business executives to find out what they are most worried about losing and create an informed security strategy based on that,” said Smith.