Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

5/14/2014
06:00 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

On The Trail of An Iranian Hacking Operation

The Iranian Ajax Security Team of hackers went from high-profile hacktivists posturing on Facebook to cyberspies encrypting stolen information from defense contractors.

An Iranian hacktivist group, turned cyber espionage and targeted attack team, made some rookie mistakes along the way in a recently disclosed operation against members of the US defense industry and Iranian dissidents, including a domain name that led researchers to the email address of one of the hackers. But researchers tracking the Iranian hacking operation say they have only scratched the surface of its activities.

"We're continuing to investigate them. This is not the whole story. There seems to be a little more to it... [possibly] other things going on in the background," says Adam Meyers, vice president of intelligence at CrowdStrike, which gave the so-called Ajax Security Team the nickname "Flying Kitten."

"Their spycraft overall is probably not that great," he says. "They made some slips along the way, which gave us some visibility into who's tied to it."

CrowdStrike today provided a few more details about the Ajax team, a day after FireEye published the first report about the Iranian cyberspying operation. FireEye said the Ajax team waged the so-called "Operation Saffron Rose" attacks that feature spearphishing emails, and spoofed Microsoft Outlook Web Access and VPN pages, trolling for user credentials from defense contractors and other members of the defense industry. The gang also is targeting Iranian dissidents, luring them with legitimate anti-censorship tools rigged with malware.

CrowdStrike has been watching Iran's notoriously loud and high-profile Ajax hacktivist group, best known for defacing websites, all in the name of political activism, this year transform into the new operation focused on targeted attacks.

Meyers says the group's makeover is a common theme he's seen before with APT-type groups. "They had gotten the attention of local government by doing nationalist/hacktivist-type attacks, and then they've become recruited to do some things" for a larger body, he says.

The email in the Whois records of the group's malicious domains is [email protected], but CrowdStrike researchers found that those domains initially were registered using the email address [email protected]. "Keyvan" and other Ajax Security Team members until earlier this year had a very public social media presence, with Facebook pages and their own website.

"This Internet presence has decreased significantly since early 2014, likely due to a desire to keep a lower profile now that the group is engaged in targeted intrusion activity," a CrowdStrike blog post published today said.

CrowdStrike also spotted the Ajax/Flying Kitten hackers combining credential theft and malware: "FireEye’s report notes that this adversary’s targeted intrusion activity consists of credential theft and malware delivery individually. The Flying Kitten campaigns investigated by CrowdStrike Intelligence showed that the actor actually combines the two," CrowdStrike's post said.

For example, the adversary will register a domain that spoofs the name of the targeted organization and then host a spoofed login page on that site. The phony login page grabs the victim's credentials when he logs in, and then typically redirects him to another web page with a "Browser Patch" or other download prompt. The downloaded file is the hacker gang's Stealer malware, which siphons data to a remote FTP server.

But Meyers says it's unclear whether the Ajax/Flying Kitten hackers are actually behind the malware used in the attacks. "We're not 100 percent certain these guys are the ones responsible for the actual malware. They could have been only used to establish the infrastructure."

CrowdStrike is tracking "several threat groups operating in Iran" that wage targeted attacks, he says

Darien Kindlund, director of threat research at FireEye, says the Ajax Security Team is not the only group of targeted attackers in Iran. "What you will likely see over time is they will become more specialized as they proliferate."

CrowdStrike researchers, meanwhile, also spotted a website run by Ajax/Flying Kitten called parmanpower.com, which poses as an Iraqi recruiting, training, and development business. "The website does not appear to deliver any malware, so its most likely purpose is to act as a credential-collection mechanism much like the spoofed Institute of Electrical and Electronics Engineers (IEEE) Aerospace Conference website (aeroconf2014[.]org) the adversary used earlier this year. This spoofed recruiting company website could be used to target entities across a wide range of sectors," according to CrowdStrike.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
5/22/2014 | 9:52:04 AM
Re: we need Safe and secure world
Thanks for sharing your perspective here, @aydintor. 
aydintor
50%
50%
aydintor,
User Rank: Apprentice
5/17/2014 | 1:08:44 AM
we need Safe and secure world
the hacking that is mentioned here is from part of iranian government . we (the security specialist) in iran do not like this hacking and try to have safe and secure world.we try to be ethical and improve our khnowledge with you guy.help ethical hacher and security spatialist in iran .we are against hacktivism and other international illegal behavior.just blive us that  we are good guys.we try to learn but becase of sanction we can not access usefull material but the wrong guys can by govermental facilities.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
Browsers to Enforce Shorter Certificate Life Spans: What Businesses Should Know
Kelly Sheridan, Staff Editor, Dark Reading,  7/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-17366
PUBLISHED: 2020-08-05
An issue was discovered in NLnet Labs Routinator 0.1.0 through 0.7.1. It allows remote attackers to bypass intended access restrictions or to cause a denial of service on dependent routing systems by strategically withholding RPKI Route Origin Authorisation ".roa" files or X509 Certificate...
CVE-2020-9036
PUBLISHED: 2020-08-05
Jeedom through 4.0.38 allows XSS.
CVE-2020-15127
PUBLISHED: 2020-08-05
In Contour ( Ingress controller for Kubernetes) before version 1.7.0, a bad actor can shut down all instances of Envoy, essentially killing the entire ingress data plane. GET requests to /shutdown on port 8090 of the Envoy pod initiate Envoy's shutdown procedure. The shutdown procedure includes flip...
CVE-2020-15132
PUBLISHED: 2020-08-05
In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the "Forget password" feature on the login screen is used, Sulu asks the user for a username or email address. If the given string is not found, a response with a `400` error code is returned, along with a error message saying that th...
CVE-2020-7298
PUBLISHED: 2020-08-05
Unexpected behavior violation in McAfee Total Protection (MTP) prior to 16.0.R26 allows local users to turn off real time scanning via a specially crafted object making a specific function call.