Kaspersky finds a new APT campaign targeting engineers in the Middle East

guest · Mar 24, 2020

Kaspersky finds a new APT campaign targeting engineers in the Middle East
March 24, 2020
https://www.cyberscoop.com/middle-east-apt-kapersky-industrial/

A mysterious set of hackers last year began a targeted campaign to breach industrial organizations in the Middle East, antivirus firm Kaspersky said Tuesday.

Attackers have sought to breach engineers, particularly in a single, unnamed Middle Eastern country, adding to a long history of cyber operations in the region.

The sensitivity of the targets, and the fact that the activity is ongoing, prompted the researchers to go public with their findings. The Moscow-based company labeled the activity an “advanced persistent threat” (APT), a loose term for well-resourced hackers often linked to government interests. Kaspersky designated the hacking campaign “WildPressure.”

“Anytime the industrial sector is being targeted, it’s concerning,” said Kaspersky senior security researcher Denis Legezo. There is no indication that hackers have done anything beyond gather information from the compromised networks, he added.
Click to expand...

“We made this conclusion [ that it is an APT because] the malware is rare, targets a very specific region, and is suitable for espionage,” Legezo told CyberScoop, “So far we have no data regarding sponsorship.”
Click to expand...

Kaspersky: WildPressure targets industrial-related entities in the Middle East

In August 2019, Kaspersky discovered a malicious campaign distributing a fully fledged C++ Trojan that we call Milum. All the victims we registered were organizations from the Middle East.
Why we call it Milum and why it’s of interest
All the aforementioned C++ Trojans are compiled as standalone PE files, originally named Milum46_Win32.exe. The word ‘milum’ is used in the C++ class names inside the malware, so we named the Trojan after it.
Click to expand...

To sum up
To date, we don’t have any data regarding Milum’s spreading mechanism. A campaign that is, apparently, exclusively targeting entities in the Middle East (at least some of them are industrial-related) is something that automatically attracts the attention of any analyst. Any similarities should be considered weak in terms of attribution, and may simply be techniques copied from previous well-known cases.
Indeed, this “learning from more experienced attackers” cycle has been adopted by some interesting new actors in recent years.

We should also be cautious regarding the true targeting of this new set of activities, as it is probably too soon to jump to conclusions. The targeted nature seems to be clear, but the targeting itself might be limited by our own visibility. The malware is not exclusively designed against any kind of victim in particular and might be reused in other operations.
Click to expand...

Log in or Sign up

Kaspersky finds a new APT campaign targeting engineers in the Middle East

guest Guest

Log in or Sign up

Kaspersky finds a new APT campaign targeting engineers in the Middle East

guest Guest

Useful Searches