Menu
Israel targeted by malware packaged with pornographic video

Israel targeted by malware packaged with pornographic video

Trend Micro said two campaigns, one sophisticated and one not, shared the same infrastructure

Israeli institutions have been targeted by an Arab-speaking hacker group that sought to extract sensitive documents, according to Trend Micro.

The campaign, which Trend called Operation Arid Viper, focused on sending phishing emails to targets. Those emails came with malware packaged with a short pornographic video, according to the company's report.

The phishing emails were sent to targets including a government office, infrastructure providers, a military organization and academic institutions in Israel and Kuwait.

The attacks "targeted professionals who might be receiving very inappropriate content at work and so would hesitate to report the incident," Trend wrote. "These victims' failure to act on the threat could have then allowed the main malware to remain undiscovered."

The malware then began hunting around on a victim's hard disk for Word, Excel, PowerPoint and text files. It reported the files to the command and control server, which then decided which files to steal.

The command-and-control servers used by Arid Viper were "closely locked down, providing very little hint that could aid our investigation," Trend said.

Trend found the Arid Viper attacks shared the same command-and-control infrastructure as another campaign it calls Advtravel, although the style of attacks are very different.

The company gained insight into Advtravel after a server connected with the operation was left open on the Internet.

"This allowed us to download copies of its entire content to study as part of our investigation before its owners realized their mistake and locked it down," the report said.

The Advtravel attackers infected more than 500 systems of mostly Arabs living in Egypt. They focused on stealing images from victims' computers, many of which were screenshots of Facebook profiles, perhaps in an attempt to identify victims.

"This could be a sign that they are looking for incriminating or compromising images for blackmail purposes," Trend wrote. "As such, the attackers may be less-skilled hackers who are not after financial gain nor hacking for espionage purposes."

Overall, the Advtravel attackers were much less skilled than Arid Viper. "They look like a classic group of beginner hackers just starting their careers," Trend said.

Trend did extensive research into the email addresses used to register domain names use for Arid Viper's command-and-control infrastructure as well as Advtravel, linking some possible actors to the Gaza Strip.

But it cautioned that such analysis was not definitive, as the attackers could have easily faked information required to register domain names.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk


Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags trend microsecuritymalware

Featured

Slideshows

Sizing up the NZ security spectrum - Where's the channel sweet spot?

Sizing up the NZ security spectrum - Where's the channel sweet spot?

From new extortion schemes, outside threats and rising cyber attacks, the art of securing the enterprise has seldom been so complex or challenging. With distance no longer a viable defence, Kiwi businesses are fighting to stay ahead of the security curve. In total, 28 per cent of local businesses faced a cyber attack last year, with the number in New Zealand set to rise in 2017. Yet amidst the sensationalism, media headlines and ongoing high profile breaches, confusion floods the channel, as partners seek strategic methods to combat rising sophistication from attackers. In sizing up the security spectrum, this Reseller News roundtable - in association with F5 Networks, Kaspersky Lab, Tech Data, Sophos and SonicWall - assessed where the channel sweet spot is within the New Zealand channel. Photos by Maria Stefina.

Sizing up the NZ security spectrum - Where's the channel sweet spot?
Kiwi channel comes together for another round of After Hours

Kiwi channel comes together for another round of After Hours

The channel came together for another round of After Hours, with a bumper crowd of distributors, vendors and partners descending on The Jefferson in Auckland. Photos by Maria Stefina.​

Kiwi channel comes together for another round of After Hours
Consegna comes to town with AWS cloud offerings launch in Auckland

Consegna comes to town with AWS cloud offerings launch in Auckland

Emerging start-up Consegna has officially launched its cloud offerings in the New Zealand market, through a kick-off event held at Seafarers Building in Auckland.​ Founded in June 2016, the Auckland-based business is backed by AWS and supported by a global team of cloud specialists, leveraging global managed services partnerships with Rackspace locally.

Consegna comes to town with AWS cloud offerings launch in Auckland
Show Comments