Attacks/Breaches
6/4/2014
01:45 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Molerats Go After Governments, US Financial Institution

Middle Eastern hacking group uses new malware, same tactics.

Cyber espionage does not just happen between China and the United States. Molerats, a hacking group based in the Middle East, is also at work. FireEye has found that the group is using a newer remote access tool (RAT) and aiming at several government entities and one US financial institution.

Between April 29 and May 27 FireEye saw Molerats using Xtreme, a freeware RAT in use by a wide variety of actors. They are disseminating the malware mainly through spear-phishing messages that contain decoy documents that focus on active conflicts in the Middle East. They are also using forged certificates, claiming to be from Microsoft, Kaspersky, or Authenticode.

Targets of this particular set of attacks include Palestinian and Israeli surveillance targets; government departments in Israel, Turkey, Slovenia, Macedonia, New Zealand, Latvia, the US, and the UK; the BBC; and an unnamed major US financial institution.

Although Molerats has used other freeware before -- including Poison Ivy, Cybergate, and Bifrost -- these techniques are consistent with Molerats' activity since as early as October 2011.

"We haven't seen a lot of evolution in their tactics," says Ned Moran, senior intelligence analyst at FireEye, noting that the attackers haven't changed much despite knowing that security companies are aware of them. "It's interesting. It makes my job easier.

"It's possible they're not well-resourced," says Moran, in reference to their use of freeware. "Or they don't want to develop a customized tool that will fingerprint them. When there's a higher signal-to-noise ratio it's harder to identify the source."

The FireEye blog from yesterday (not written by Moran), however does point out some ways that Molerats are tweaking their habits:

The port 443 callback listed in the last sample is also not using actual SSL, but instead, the sample transmits communications in clear-text – a common tactic employed by adversaries to try and bypass firewall/proxy rules applying to communications over traditional web ports. These tactics... seem to indicate that Molerats are not only aware of security researchers’ efforts in trying to track them but are also attempting to avoid using any obvious, repeating patterns that could be used to more easily track endpoints infected with their malware.

The blog also speculates that Molerats might be trying to convince victims that the attacks are deriving from China. Although the decoy documents are all written in Arabic or English, some of the messages and documents contain some Chinese characters.

"I'm not convinced it's an effort to make them look Chinese," says Moran, who believes the presence of Chinese characters is due to the fact that they're borrowing shared attack tools. "I think in this case it's purely coincidental."

It is not clear whether or not Molerats is state-sponsored. The group probably has few resources, and the Middle East is comparatively new to the cybercrime arena, which could explain the fact that its techniques aren't all that sophisticated yet.

It is also not clear what Molerats' end game is, but the nature of the targets leads Moran to believe that they are seeking out "strategic intelligence," instead of money or intellectual property. (The FireEye researchers have asked themselves what is unique about the particular financial institution targeted in this latest series of attacks that would connect it to the other targeted organizations, but they don't have an answer for that yet.)

"The main theme we're trying to get across is that cyber espionage has been democratized," says Moran. "Everyone's doing it now... It could be the big boys. Or it could be the kids next door."

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-1032
Published: 2014-09-17
Cross-site scripting (XSS) vulnerability in the Euroling SiteSeeker module 3.x before 3.4.5 for EPiServer allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party inf...

CVE-2012-1417
Published: 2014-09-17
Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject arbitrary web script or HTML via the user field to cgi-bin/ConfigManApp.com.

CVE-2012-1506
Published: 2014-09-17
SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated users to execute arbitrary SQL commands via the hspSummaryId parameter to plugins/ajaxCalls/haltResumeHsp.php. NOTE: some of these details are obtained from th...

CVE-2012-1507
Published: 2014-09-17
Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) newHspStatus parameter to plugins/ajaxCalls/haltResumeHsp.php, (2) sortOrder1 parameter to templates/hrfunct/emppop.php, or (3) uri parameter to index...

CVE-2012-2583
Published: 2014-09-17
Cross-site scripting (XSS) vulnerability in Mini Mail Dashboard Widget plugin 1.42 for WordPress allows remote attackers to inject arbitrary web script or HTML via the body of an email.

Best of the Web
Dark Reading Radio
Listen Now A Grown-Up Conversation About Passwords
A Grown-Up Conversation About Passwords