Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/4/2014
01:45 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Molerats Go After Governments, US Financial Institution

Middle Eastern hacking group uses new malware, same tactics.

Cyber espionage does not just happen between China and the United States. Molerats, a hacking group based in the Middle East, is also at work. FireEye has found that the group is using a newer remote access tool (RAT) and aiming at several government entities and one US financial institution.

Between April 29 and May 27 FireEye saw Molerats using Xtreme, a freeware RAT in use by a wide variety of actors. They are disseminating the malware mainly through spear-phishing messages that contain decoy documents that focus on active conflicts in the Middle East. They are also using forged certificates, claiming to be from Microsoft, Kaspersky, or Authenticode.

Targets of this particular set of attacks include Palestinian and Israeli surveillance targets; government departments in Israel, Turkey, Slovenia, Macedonia, New Zealand, Latvia, the US, and the UK; the BBC; and an unnamed major US financial institution.

Although Molerats has used other freeware before -- including Poison Ivy, Cybergate, and Bifrost -- these techniques are consistent with Molerats' activity since as early as October 2011.

"We haven't seen a lot of evolution in their tactics," says Ned Moran, senior intelligence analyst at FireEye, noting that the attackers haven't changed much despite knowing that security companies are aware of them. "It's interesting. It makes my job easier.

"It's possible they're not well-resourced," says Moran, in reference to their use of freeware. "Or they don't want to develop a customized tool that will fingerprint them. When there's a higher signal-to-noise ratio it's harder to identify the source."

The FireEye blog from yesterday (not written by Moran), however does point out some ways that Molerats are tweaking their habits:

The port 443 callback listed in the last sample is also not using actual SSL, but instead, the sample transmits communications in clear-text – a common tactic employed by adversaries to try and bypass firewall/proxy rules applying to communications over traditional web ports. These tactics... seem to indicate that Molerats are not only aware of security researchers’ efforts in trying to track them but are also attempting to avoid using any obvious, repeating patterns that could be used to more easily track endpoints infected with their malware.

The blog also speculates that Molerats might be trying to convince victims that the attacks are deriving from China. Although the decoy documents are all written in Arabic or English, some of the messages and documents contain some Chinese characters.

"I'm not convinced it's an effort to make them look Chinese," says Moran, who believes the presence of Chinese characters is due to the fact that they're borrowing shared attack tools. "I think in this case it's purely coincidental."

It is not clear whether or not Molerats is state-sponsored. The group probably has few resources, and the Middle East is comparatively new to the cybercrime arena, which could explain the fact that its techniques aren't all that sophisticated yet.

It is also not clear what Molerats' end game is, but the nature of the targets leads Moran to believe that they are seeking out "strategic intelligence," instead of money or intellectual property. (The FireEye researchers have asked themselves what is unique about the particular financial institution targeted in this latest series of attacks that would connect it to the other targeted organizations, but they don't have an answer for that yet.)

"The main theme we're trying to get across is that cyber espionage has been democratized," says Moran. "Everyone's doing it now... It could be the big boys. Or it could be the kids next door."

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ...
View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15930
PUBLISHED: 2020-09-24
An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag.
CVE-2020-19447
PUBLISHED: 2020-09-24
SQL injection exists in the jdownloads 3.2.63 component for Joomla! com_jdownloads/models/send.php via the f_marked_files_id parameter.
CVE-2020-3560
PUBLISHED: 2020-09-24
A vulnerability in Cisco Aironet Access Points (APs) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) on an affected device. The vulnerability is due to improper resource management while processing specific packets. An attacker could exploit this vulnerability by s...
CVE-2020-3509
PUBLISHED: 2020-09-24
A vulnerability in the DHCP message handler of Cisco IOS XE Software for Cisco cBR-8 Converged Broadband Routers could allow an unauthenticated, remote attacker to cause the supervisor to crash, which could result in a denial of service (DoS) condition. The vulnerability is due to insufficient error...
CVE-2020-3510
PUBLISHED: 2020-09-24
A vulnerability in the Umbrella Connector component of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches could allow an unauthenticated, remote attacker to trigger a reload, resulting in a denial of service condition on an affected device. The vulnerability is due to insufficient error h...