Feeds

Iranian hacktivists move into hardcore hacking against West, dissidents

Ajax wiping up with state support?

Using blade systems to cut costs and sharpen efficiencies

Security firm FireEye has been tracking an Iranian hacking group that has moved from simple defacement of websites to actively targeting Western defense contractors and those within Iran's borders who are trying to circumvent the regime's censorship firewall.

The hacking group, calling itself the Ajax Security Team, has been active for the last five years. FireEye has been tracking the group on online forums, and says it began life as a loose collection of individuals getting together to find flaws in websites that would allow for defacement with pro-Iranian messages.

But these attacks have now stopped – the last was recorded last December – and the AST has been using its own custom malware to get into the espionage business. The team developed malware dubbed Stealer which, while not particularly advanced, has proven rather effective.

Stealer is built into a CAB extractor, and once activated, writes itself onto the target's drive as IntelRS.exe. This then adds in a backdoor to the target system that communicates with command and control servers over FTP, a keylogger, and screenshot collector.

The first target of the group has been Western defense companies, particularly those in the aerospace industry. The group registered the domain aeroconf2014[.]org, similar to the IEEE Aerospace conference website, and sent out emails to companies in the field with a phony login page.

If the recipient tried to register for the conference, they would be prompted to download proxy software to access the site, which is when the Stealer software gets onto the target's system. FireEye's director of threat research Darien Kindlund told El Reg that these kind of attacks are still ongoing by the group.

The malware is quite primitive in that it doesn't seek to exploit a zero-day vulnerability but instead relies on social engineering to get the user to install the malware. Nevertheless, that's still an effective tactic, he said, and multiple companies are under attack as a result of the code.

The second target for the group is Iranian citizens looking to get uncensored information via free proxy services. FireEye has tracked numerous cases of the malware being embedded in software such as Proxifier or Psiphon.

Over the course of their research, FireEye found data from 77 infected individuals, the bulk of whose computers had their clocks set to Iran Standard Time and were using Persian language settings.

Given the choice of targets, Kindlund said that it was likely that the group is either state-sponsored or state-supported. While one member of the hacking group has tried spreading malware for pecuniary gain, the bulk of their activities have been intelligence-gathering.

"The increased politicization of the Ajax Security Team, and the transition from nuisance defacements to operations against internal dissidents and foreign targets, coincides with moves by Iran aimed at increasing offensive cyber capabilities," FireEye's report concludes.

"While the relationship between actors such as the Ajax Security Team and the Iranian government remains unclear, their activities appear to align with Iranian government political objectives." ®

The smart choice: opportunity from uncertainty

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Attackers raid SWISS BANKS with DNS and malware bombs
'Retefe' trojan uses clever spin on old attacks to grant total control of bank accounts
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.