Feeds

Snooping, RAT-flinging, hack-happy crew targeting governments worldwide – researchers

Molerats reportedly targeted US, UK... and Macedonia?

Protecting against web application threats using SSL

The Middle East-based Molerats hacker crew are even more active than first suspected, according to a report by researchers who claim the team has launched attacks against an unnamed US financial institution and multiple European governments.

FireEye said it had identified the expanded list of targets after putting the command-and-control infrastructure used by the hacker crew under the microscope. In the process the firm uncovered both Palestinian and Israeli surveillance targets as well as evidence that the gang targeted government departments in the the UK, US, UK, Turkey, Slovenia, Macedonia, Latvia and New Zealand, among others.

The group also had a pop at a major US financial institution and the BBC since its first analysis of the group back in August 2013, FireEye claimed. The hacking team commonly uses basic but effective malware, such as the Poison Ivy Remote Access Tool (RAT), to hack into the systems of targeted organisations.

The new attacks use the same old tactics that have become the hallmark of Molerats' spying since the group first surfaced in October 2011, FireEye researchers have discovered.

Previous Molerats campaigns have used several garden-variety, freely available backdoors such as CyberGate and Bifrost, but, most recently, we have observed them making use of the PIVY and Xtreme RATs.

Previous campaigns made use of at least one of three observed forged Microsoft certificates, allowing security researchers to accurately tie together separate attacks even if the attacks used different backdoors. There also appears to be a habitual use of lures or decoy documents – in either English or Arabic-language – with content focusing on active conflicts in the Middle East.

Topics of the decoy documents used in spear-phishing attacks by the Molerats include news articles about ongoing Palestinian reconciliation meetings between Fatah and Hamas in the Gaza strip, as explained in greater detail in a blog post by FireEye here. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.