Attacks/Breaches
6/4/2014
01:45 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Molerats Go After Governments, US Financial Institution

Middle Eastern hacking group uses new malware, same tactics.

Cyber espionage does not just happen between China and the United States. Molerats, a hacking group based in the Middle East, is also at work. FireEye has found that the group is using a newer remote access tool (RAT) and aiming at several government entities and one US financial institution.

Between April 29 and May 27 FireEye saw Molerats using Xtreme, a freeware RAT in use by a wide variety of actors. They are disseminating the malware mainly through spear-phishing messages that contain decoy documents that focus on active conflicts in the Middle East. They are also using forged certificates, claiming to be from Microsoft, Kaspersky, or Authenticode.

Targets of this particular set of attacks include Palestinian and Israeli surveillance targets; government departments in Israel, Turkey, Slovenia, Macedonia, New Zealand, Latvia, the US, and the UK; the BBC; and an unnamed major US financial institution.

Although Molerats has used other freeware before -- including Poison Ivy, Cybergate, and Bifrost -- these techniques are consistent with Molerats' activity since as early as October 2011.

"We haven't seen a lot of evolution in their tactics," says Ned Moran, senior intelligence analyst at FireEye, noting that the attackers haven't changed much despite knowing that security companies are aware of them. "It's interesting. It makes my job easier.

"It's possible they're not well-resourced," says Moran, in reference to their use of freeware. "Or they don't want to develop a customized tool that will fingerprint them. When there's a higher signal-to-noise ratio it's harder to identify the source."

The FireEye blog from yesterday (not written by Moran), however does point out some ways that Molerats are tweaking their habits:

The port 443 callback listed in the last sample is also not using actual SSL, but instead, the sample transmits communications in clear-text – a common tactic employed by adversaries to try and bypass firewall/proxy rules applying to communications over traditional web ports. These tactics... seem to indicate that Molerats are not only aware of security researchers’ efforts in trying to track them but are also attempting to avoid using any obvious, repeating patterns that could be used to more easily track endpoints infected with their malware.

The blog also speculates that Molerats might be trying to convince victims that the attacks are deriving from China. Although the decoy documents are all written in Arabic or English, some of the messages and documents contain some Chinese characters.

"I'm not convinced it's an effort to make them look Chinese," says Moran, who believes the presence of Chinese characters is due to the fact that they're borrowing shared attack tools. "I think in this case it's purely coincidental."

It is not clear whether or not Molerats is state-sponsored. The group probably has few resources, and the Middle East is comparatively new to the cybercrime arena, which could explain the fact that its techniques aren't all that sophisticated yet.

It is also not clear what Molerats' end game is, but the nature of the targets leads Moran to believe that they are seeking out "strategic intelligence," instead of money or intellectual property. (The FireEye researchers have asked themselves what is unique about the particular financial institution targeted in this latest series of attacks that would connect it to the other targeted organizations, but they don't have an answer for that yet.)

"The main theme we're trying to get across is that cyber espionage has been democratized," says Moran. "Everyone's doing it now... It could be the big boys. Or it could be the kids next door."

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: just wondering...Thanx
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.