How Hackers Plant False Flags to Hide Their Real Identities:
During the first half of 2015, a mysterious hacking group allegedly started attacking military and government organizations in Peru in what looked like a routine—even run-of-the-mill—espionage campaign.
The group used an old exploit and “clunky” malware, nothing particularly notable. What was unusual about this operation was that the malware was signed with a stolen digital certificate that had already been used by the hackers responsible for disrupting an Iranian nuclear power plant in the famous Stuxnet attack, according to security firm Kaspersky Lab.
All this made very little sense.
The use of the stolen certificate made it look like the hacking group was the same as the Stuxnet attack, or was it just a trick? Security experts often repeat a mantra: “attribution is hard.” Finding out who is responsible for a cyberattack is a complicated, often impossible task, and in some cases, hackers make it even harder by leaving misleading clues, like in the case of the Peruvian attacks.
Source: Vice Magazine