Feeds

Iranian hacktivists move into hardcore hacking against West, dissidents

Ajax wiping up with state support?

The essential guide to IT transformation

Security firm FireEye has been tracking an Iranian hacking group that has moved from simple defacement of websites to actively targeting Western defense contractors and those within Iran's borders who are trying to circumvent the regime's censorship firewall.

The hacking group, calling itself the Ajax Security Team, has been active for the last five years. FireEye has been tracking the group on online forums, and says it began life as a loose collection of individuals getting together to find flaws in websites that would allow for defacement with pro-Iranian messages.

But these attacks have now stopped – the last was recorded last December – and the AST has been using its own custom malware to get into the espionage business. The team developed malware dubbed Stealer which, while not particularly advanced, has proven rather effective.

Stealer is built into a CAB extractor, and once activated, writes itself onto the target's drive as IntelRS.exe. This then adds in a backdoor to the target system that communicates with command and control servers over FTP, a keylogger, and screenshot collector.

The first target of the group has been Western defense companies, particularly those in the aerospace industry. The group registered the domain aeroconf2014[.]org, similar to the IEEE Aerospace conference website, and sent out emails to companies in the field with a phony login page.

If the recipient tried to register for the conference, they would be prompted to download proxy software to access the site, which is when the Stealer software gets onto the target's system. FireEye's director of threat research Darien Kindlund told El Reg that these kind of attacks are still ongoing by the group.

The malware is quite primitive in that it doesn't seek to exploit a zero-day vulnerability but instead relies on social engineering to get the user to install the malware. Nevertheless, that's still an effective tactic, he said, and multiple companies are under attack as a result of the code.

The second target for the group is Iranian citizens looking to get uncensored information via free proxy services. FireEye has tracked numerous cases of the malware being embedded in software such as Proxifier or Psiphon.

Over the course of their research, FireEye found data from 77 infected individuals, the bulk of whose computers had their clocks set to Iran Standard Time and were using Persian language settings.

Given the choice of targets, Kindlund said that it was likely that the group is either state-sponsored or state-supported. While one member of the hacking group has tried spreading malware for pecuniary gain, the bulk of their activities have been intelligence-gathering.

"The increased politicization of the Ajax Security Team, and the transition from nuisance defacements to operations against internal dissidents and foreign targets, coincides with moves by Iran aimed at increasing offensive cyber capabilities," FireEye's report concludes.

"While the relationship between actors such as the Ajax Security Team and the Iranian government remains unclear, their activities appear to align with Iranian government political objectives." ®

Next gen security for virtualised datacentres

More from The Register

next story
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
Think crypto hides you from spooks on Facebook? THINK AGAIN
Traffic fingerprints reveal all, say boffins
Rupert Murdoch says Google is worse than the NSA
Mr Burns vs. The Chocolate Factory, round three!
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.