Two waves of MH370-themed cyberattacks

Keep the two waves apart. The 9 March job hit machines inside the investigation: about thirty computers, malware that conventional antivirus missed, outbound mail carrying minutes and classified documents, some of it MH370-related, toward an IP address in China. CyberSecurity Malaysia, police and Interpol worked the case; Chinese ISPs were asked to block the traffic. That is CSM’s account, given by CEO Amirudin Abdul Wahab to The Star and published 20 August 2014. Attack two is the public-facing MH370 lure season: MyCERT MA-381 (24 March) on a Facebook-app backdoor with remote-control capability, and MA-386 (18 April) on a spear-phish posing as an investigation team / ICAO portal item that dropped a fake transcript and command-and-control. FireEye separately logged MH370-lure spear-phish against an Asia-Pacific government and a US think tank in mid-March. None of that, on present records, names the radar feeds or proves the 9 March take included the westbound primary track. Attribution remains open: state-linked, non-state, third-party infrastructure, or false flag are all still live.