Attacks/Breaches

2/17/2017
03:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

At Least 70 Organizations Targeted In Sophisticated Cyber Surveillance Operation

Most of the targets are in Ukraine, though a few have been spotted in Russia and elsewhere, CyberX says

At least 70 organizations across multiple industries including critical infrastructure, scientific research and media have been hit in a sophisticated cyber-surveillance campaign conducted by threat actors with potential nation state connections.

A majority of the victim organizations are Ukraine based, though a handful of targets have also been spotted in Russia, Austria and Saudi Arabia as well. 

Security vendor CyberX uncovered the operation after discovering malware used in the attacks in the wild and then reverse engineering it.

The company has dubbed the campaign Operation BugDrop because one of the methods employed by the threat actors behind it to collect data is to eavesdrop on conversations via the victim’s PC microphone. The tactic is highly effective because a computer microphone, unlike a video camera, is almost impossible to block without actually disabling the associated hardware, CyberX noted in a blog.

The focus of BugDrop appears to be to capture a range of sensitive information from targets via audio recordings of conversations and via documents, screenshots and passwords from victim system, according to CyberX.

The targeting of the victims is similar to that of Operation Groundbait, a cyber surveillance campaign uncovered by ESET last May.

As with the Groundbait campaign, many of the victims of BugDrop are located in Luhansk and Donetsk, two states that have proclaimed themselves to be independent from Ukraine and are regarded as terrorist states for that reason by the government there. Many of the tactics, techniques and procedures used in the BugDrop campaign — including the use of spear phishing emails and malicious macros — are also similar to those used in Groundbait.

Even so, BugDrop appears to be a more sophisticated and better-resourced operation than Groundbait, says Phil Neray, vice president of industrial control security at CyberX.

For example, the operators of BugDrop are using DropBox to store data exfiltrated from victim systems, making it harder to spot the illegal activity. “DropBox is a cloud-based service and it is very easy to upload data to it without having any firewalls or monitoring systems see anything suspicious or unusual” Neray says. All data stored in DropBox is also encrypted.

The malware itself is stored on a free web hosting service, which makes it harder to track the threat actors behind it. In contrast, the operators of Groundbait hosted their malware on a command and control server on a domain they had created thereby giving investigators a way to get clues to their identity from the registration details.

Operation BugDrop also employs a sophisticated malware detection evasion technique known as Reflective DLL Injection to inject malicious code on victim systems, Neray says. The method involves loading malicious code into memory without calling the usual Windows API call so as to bypass security verification of the code. The same approach was used in the BlackEnergy campaign on Ukraine’s electric grid, and in Stuxnet attacks in Iran, he noted.

Another pointer to the sophistication and resources available to the operators of BugDrop comes from the amount and type of data being collected and presumably analyzed.  At least 2 GB to 3 GB of unstructured data are being uploaded to the DropBox accounts daily.

This means the operators of BugDrop must have a sizeable infrastructure for storing and decrypting the data and access to skilled human analysts for extracting value from the data, Neray says.  “If you think about it, this is not like credit card data,” he says. “You need to have human analysts to look at the data.”

The organizational and logistical planning required for analyzing unstructured data at this scale daily suggests nation-state level capabilities he says.

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20161
PUBLISHED: 2018-12-15
A design flaw in the BlinkForHome (aka Blink For Home) Sync Module 2.10.4 and earlier allows attackers to disable cameras via Wi-Fi, because incident clips (triggered by the motion sensor) are not saved if the attacker's traffic (such as Dot11Deauth) successfully disconnects the Sync Module from the...
CVE-2018-20159
PUBLISHED: 2018-12-15
i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a "...
CVE-2018-20157
PUBLISHED: 2018-12-15
The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing attackers to read arbitrary files.
CVE-2018-20154
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses.
CVE-2018-20155
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings.