Feeds

Iranian hacktivists move into hardcore hacking against West, dissidents

Ajax wiping up with state support?

Providing a secure and efficient Helpdesk

Security firm FireEye has been tracking an Iranian hacking group that has moved from simple defacement of websites to actively targeting Western defense contractors and those within Iran's borders who are trying to circumvent the regime's censorship firewall.

The hacking group, calling itself the Ajax Security Team, has been active for the last five years. FireEye has been tracking the group on online forums, and says it began life as a loose collection of individuals getting together to find flaws in websites that would allow for defacement with pro-Iranian messages.

But these attacks have now stopped – the last was recorded last December – and the AST has been using its own custom malware to get into the espionage business. The team developed malware dubbed Stealer which, while not particularly advanced, has proven rather effective.

Stealer is built into a CAB extractor, and once activated, writes itself onto the target's drive as IntelRS.exe. This then adds in a backdoor to the target system that communicates with command and control servers over FTP, a keylogger, and screenshot collector.

The first target of the group has been Western defense companies, particularly those in the aerospace industry. The group registered the domain aeroconf2014[.]org, similar to the IEEE Aerospace conference website, and sent out emails to companies in the field with a phony login page.

If the recipient tried to register for the conference, they would be prompted to download proxy software to access the site, which is when the Stealer software gets onto the target's system. FireEye's director of threat research Darien Kindlund told El Reg that these kind of attacks are still ongoing by the group.

The malware is quite primitive in that it doesn't seek to exploit a zero-day vulnerability but instead relies on social engineering to get the user to install the malware. Nevertheless, that's still an effective tactic, he said, and multiple companies are under attack as a result of the code.

The second target for the group is Iranian citizens looking to get uncensored information via free proxy services. FireEye has tracked numerous cases of the malware being embedded in software such as Proxifier or Psiphon.

Over the course of their research, FireEye found data from 77 infected individuals, the bulk of whose computers had their clocks set to Iran Standard Time and were using Persian language settings.

Given the choice of targets, Kindlund said that it was likely that the group is either state-sponsored or state-supported. While one member of the hacking group has tried spreading malware for pecuniary gain, the bulk of their activities have been intelligence-gathering.

"The increased politicization of the Ajax Security Team, and the transition from nuisance defacements to operations against internal dissidents and foreign targets, coincides with moves by Iran aimed at increasing offensive cyber capabilities," FireEye's report concludes.

"While the relationship between actors such as the Ajax Security Team and the Iranian government remains unclear, their activities appear to align with Iranian government political objectives." ®

New hybrid storage solutions

More from The Register

next story
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.