Feeds

Iranian hacktivists move into hardcore hacking against West, dissidents

Ajax wiping up with state support?

Remote control for virtualized desktops

Security firm FireEye has been tracking an Iranian hacking group that has moved from simple defacement of websites to actively targeting Western defense contractors and those within Iran's borders who are trying to circumvent the regime's censorship firewall.

The hacking group, calling itself the Ajax Security Team, has been active for the last five years. FireEye has been tracking the group on online forums, and says it began life as a loose collection of individuals getting together to find flaws in websites that would allow for defacement with pro-Iranian messages.

But these attacks have now stopped – the last was recorded last December – and the AST has been using its own custom malware to get into the espionage business. The team developed malware dubbed Stealer which, while not particularly advanced, has proven rather effective.

Stealer is built into a CAB extractor, and once activated, writes itself onto the target's drive as IntelRS.exe. This then adds in a backdoor to the target system that communicates with command and control servers over FTP, a keylogger, and screenshot collector.

The first target of the group has been Western defense companies, particularly those in the aerospace industry. The group registered the domain aeroconf2014[.]org, similar to the IEEE Aerospace conference website, and sent out emails to companies in the field with a phony login page.

If the recipient tried to register for the conference, they would be prompted to download proxy software to access the site, which is when the Stealer software gets onto the target's system. FireEye's director of threat research Darien Kindlund told El Reg that these kind of attacks are still ongoing by the group.

The malware is quite primitive in that it doesn't seek to exploit a zero-day vulnerability but instead relies on social engineering to get the user to install the malware. Nevertheless, that's still an effective tactic, he said, and multiple companies are under attack as a result of the code.

The second target for the group is Iranian citizens looking to get uncensored information via free proxy services. FireEye has tracked numerous cases of the malware being embedded in software such as Proxifier or Psiphon.

Over the course of their research, FireEye found data from 77 infected individuals, the bulk of whose computers had their clocks set to Iran Standard Time and were using Persian language settings.

Given the choice of targets, Kindlund said that it was likely that the group is either state-sponsored or state-supported. While one member of the hacking group has tried spreading malware for pecuniary gain, the bulk of their activities have been intelligence-gathering.

"The increased politicization of the Ajax Security Team, and the transition from nuisance defacements to operations against internal dissidents and foreign targets, coincides with moves by Iran aimed at increasing offensive cyber capabilities," FireEye's report concludes.

"While the relationship between actors such as the Ajax Security Team and the Iranian government remains unclear, their activities appear to align with Iranian government political objectives." ®

Remote control for virtualized desktops

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.