Hezbollah linked hackers hit companies in global malware attack

guest · Jan 30, 2021

Hezbollah linked hackers hit companies in global malware attack
January 29, 2021
https://www.hackread.com/hezbollah-hackers-global-malware-attack/

It is a fact that hackers from Hezbollah and Hamas have carried out successful cyberattacks against Israel including hacking security cameras installed in government buildings or Hamas hacking smartphones of IDF soldiers using seductive images.

In the latest report published by Israeli cybersecurity firm ClearSky, it has been revealed that an APT group affiliated with Hezbollah Cyber Unit, called Volatile Cedar or Lebanese Cedar has been targeting countries around the world including Israel, United Kingdom, and Saudi Arabia.
Click to expand...

Volatile Cedar- The Emerging Threat
According to ClearSky, the APT group has developed a new version of Explosive malware RAT [PDF] (remote access trojan) and stealthily hacking businesses worldwide by stealing sensitive data like call records, intelligence information, etc.

The group also frequently performs espionage operations while in case its target is a telecom firm, their aim is to steal private data, claims ClearSky.

“In case of telecommunication companies, one can assume that databases containing call records and private data of clients were accessed as well,” ClearSky researchers stated in a report [PDF].
Click to expand...

ClearSky: ‘Lebanese Cedar’ APT

In early 2020, suspicious network activities and hacking tools were found in a range of companies. Comprehensive forensic research of the infected systems revealed a strong connection to a threat actor we call ‘Lebanese Cedar’, ‘Lebanese Cedar’ APT has been operating since 2012. These operations were first discovered by Check-Point researchers and Kaspersky labs in 2015. Since 2015 Lebanese Cedar APT – also referred to as “Volatile Cedar” – maintained a low profile and operated under the radar.
Click to expand...

According to Check-Point’s report, the group is motivated by political and Ideological interests, targeting individuals, companies, and institutions worldwide. We endorse Check Point’s strong case attributing Lebanese Cedar APT to the Lebanese government or a political group in Lebanon. Moreover, there are several indications that link Lebanese Cedar APT to the Hezbollah Cyber Unit.

“Caterpillar WebShell” was found in most of the victims we investigated, in many of the systems we also found traces of “Explosive” RAT. We identified the specific open-source JSP file browser that was modified for the hackers’ purposes. We found that Lebanese Cedar deployed the payload of Explosive RAT into the victims’ network. Lebanese Cedar is the only known threat actor that uses this code.
Click to expand...

Log in or Sign up

Hezbollah linked hackers hit companies in global malware attack

guest Guest

Log in or Sign up

Hezbollah linked hackers hit companies in global malware attack

guest Guest

Useful Searches