Feeds

Iraq civil war: You can fight with an AK-47 ... or a HOME-COOKED Trojan

Researcher spots spike in cyber-espionage tools

Beginner's guide to SSL certificates

Iraq's bloody civil war has spilled over onto the internet, notes a researcher that has spotted a large increase in cyber-espionage tools and other forms of malware.

Members of the Islamic State of Iraq and al-Sham (ISIS) group have made extensive use of social media to spread slickly produced propaganda as an accompaniment to their advances into northern Iraq. This has led to restrictions on social media (now partially relaxed) and blocks on various websites by Iraq's ISPs.

What's gone largely unreported, by comparison, is the accompanying sharp increase in malware activity in the strife-torn country.

"Several new botnets using dynamic DNS have been detected, which might have been used for cyber espionage and targeted multi-staged cyber attacks, reports cyber intelligence outfit IntelCrawler.

IntelCrawler adds that harmful activity is concentrated in four Iraq cities: Baghdad Erbil, Basra and Mosul. A lot of malware is home-brewed and much of it has previously featured in the Syrian civil war, where ISIS has become a key player over recent months. A substantial segment of the command nodes used in the cyber-spying were hosted on no-IP domains that later became the target of a controversial Microsoft-led takedown operation this week, IntelCrawler adds.

Collected technical indicators have also shown a large pool of self-written RAT (Remote Administration Toolkits) using Secure Sockets (SOCKS) and FTP/HTTP BackConnect with embedded file system browser for infected victims remote monitoring masked under Google Chrome and publicly available software. The usage of njRAT, one of a number of tools being used to target Syrian opposition groups during the Syrian conflict, as well as other malware related to Arabic speaking community, is also very visible in the region, having registered C&Cs at “no-ip.biz” and “zapto.org” free DNS.

Hackers are also reportedly using hacking techniques to hijack home router connections, according to IntelCrawler.

Significant numbers of SOHO-routers located in IPv4 ranges of Iraq were also compromised using targeted mass exploitation of vulnerabilities in UPnP and bruteforcing, which may lead to potential network surveillance for Internet traffic control used by conflicted parties in this region. The share of Iraqi-based bad actors involved into various illegal activities in cyberspace acting as mercenaries seems to have significantly increased. Most appear united with Egypt, Lybian, Lebanese, Iranian, Syrian and various distributed Islamic groups performing targeted attacks because of religious and political motivation supported by state parties.

®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
Desperate VXers enslave FREEZERS in DDoS bot
Updated Spike malware targets Asia
Heatmiser digital thermostat users: For pity's sake, DON'T SWITCH ON the WI-FI
A stranger turns up YOUR heat with default password 1234
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.