Attacks/Breaches
6/4/2014
01:45 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Molerats Go After Governments, US Financial Institution

Middle Eastern hacking group uses new malware, same tactics.

Cyber espionage does not just happen between China and the United States. Molerats, a hacking group based in the Middle East, is also at work. FireEye has found that the group is using a newer remote access tool (RAT) and aiming at several government entities and one US financial institution.

Between April 29 and May 27 FireEye saw Molerats using Xtreme, a freeware RAT in use by a wide variety of actors. They are disseminating the malware mainly through spear-phishing messages that contain decoy documents that focus on active conflicts in the Middle East. They are also using forged certificates, claiming to be from Microsoft, Kaspersky, or Authenticode.

Targets of this particular set of attacks include Palestinian and Israeli surveillance targets; government departments in Israel, Turkey, Slovenia, Macedonia, New Zealand, Latvia, the US, and the UK; the BBC; and an unnamed major US financial institution.

Although Molerats has used other freeware before -- including Poison Ivy, Cybergate, and Bifrost -- these techniques are consistent with Molerats' activity since as early as October 2011.

"We haven't seen a lot of evolution in their tactics," says Ned Moran, senior intelligence analyst at FireEye, noting that the attackers haven't changed much despite knowing that security companies are aware of them. "It's interesting. It makes my job easier.

"It's possible they're not well-resourced," says Moran, in reference to their use of freeware. "Or they don't want to develop a customized tool that will fingerprint them. When there's a higher signal-to-noise ratio it's harder to identify the source."

The FireEye blog from yesterday (not written by Moran), however does point out some ways that Molerats are tweaking their habits:

The port 443 callback listed in the last sample is also not using actual SSL, but instead, the sample transmits communications in clear-text – a common tactic employed by adversaries to try and bypass firewall/proxy rules applying to communications over traditional web ports. These tactics... seem to indicate that Molerats are not only aware of security researchers’ efforts in trying to track them but are also attempting to avoid using any obvious, repeating patterns that could be used to more easily track endpoints infected with their malware.

The blog also speculates that Molerats might be trying to convince victims that the attacks are deriving from China. Although the decoy documents are all written in Arabic or English, some of the messages and documents contain some Chinese characters.

"I'm not convinced it's an effort to make them look Chinese," says Moran, who believes the presence of Chinese characters is due to the fact that they're borrowing shared attack tools. "I think in this case it's purely coincidental."

It is not clear whether or not Molerats is state-sponsored. The group probably has few resources, and the Middle East is comparatively new to the cybercrime arena, which could explain the fact that its techniques aren't all that sophisticated yet.

It is also not clear what Molerats' end game is, but the nature of the targets leads Moran to believe that they are seeking out "strategic intelligence," instead of money or intellectual property. (The FireEye researchers have asked themselves what is unique about the particular financial institution targeted in this latest series of attacks that would connect it to the other targeted organizations, but they don't have an answer for that yet.)

"The main theme we're trying to get across is that cyber espionage has been democratized," says Moran. "Everyone's doing it now... It could be the big boys. Or it could be the kids next door."

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2003-1598
Published: 2014-10-01
SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable.

CVE-2011-4624
Published: 2014-10-01
Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.

CVE-2012-0811
Published: 2014-10-01
Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used in backup files gene...

CVE-2012-5485
Published: 2014-09-30
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

CVE-2012-5486
Published: 2014-09-30
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Chris Hadnagy, who hosts the annual Social Engineering Capture the Flag Contest at DEF CON, will discuss the latest trends attackers are using.