Israel's supply chain targeted in massive cyberattack

guest · Dec 13, 2020

Israel's supply chain targeted in massive cyberattack
A hack into the servers of software company Amital Data led to an attack on some 40 of its clients
December 13, 2020
https://www.calcalistech.com/ctech/articles/0,7340,L-3881337,00.html

Dozens of Israeli importers and logistics companies were struck by a severe cyberattack last weekend. The hackers managed to break into the servers of dozens of companies and penetrate Israel's supply chain.

The companies that were attacked are among Israel's biggest in the logistics sector and such an attack has the potential of severely disrupting the supply of basic commodities to the country.
Click to expand...

The lion's share of the attack was conducted via Amital Data, which provides software solutions for freight forwarders, shipping agents, airline cargo sales agents, and customs brokers.
The hackers broke into Amital's computers and stole its list of clients, including their login information, which they then used to hack into their systems.

Amital Data said in response to the report: "Two weeks ago the company's defensive systems identified attempts to attack the company's computers, as well as those of some of its clients. The incident is part of a chain of events at a national level that are being investigated and monitored by the Israel National Cyber Directorate. [...]"
Click to expand...

imdb · Dec 13, 2020

i bet it's state-sponsored cyber terrorism. could be the iranians.

guest · Dec 13, 2020

...could be the iranians.
Click to expand...

Iran Suspected After Massive Cyberattack on Israeli Firms Revealed
December 13, 2020
https://www.haaretz.com/israel-news...assive-cyberattack-on-israeli-firms-1.9368792

At least 40 Israeli companies were affected by a cyberattack very likely from Iran, after Amitai Data, which sells software to logistics companies was targeted by hackers.

News of the hack and subsequent data leak from firms using Amital Data's Unifreight software was revealed in a filing to Israel’s stock exchange by Amital's stockholder Orian.
‘40 firms hit’
Amital’s website is not live currently and in addition to Israel’s cyber authority, the private cyber firm Comsec is consulting the company as it reels from the attack.
Click to expand...

The attack against Amital's Unifreight program is not considered a ransom or extortion attack attributed to criminals, but rather it is being treated as a state-run operation, with Iran being the main suspect.
Click to expand...

imdb · Dec 13, 2020

mood said: ↑

Iran Suspected After Massive Cyberattack on Israeli Firms Revealed
December 13, 2020
https://www.haaretz.com/israel-news...assive-cyberattack-on-israeli-firms-1.9368792
Click to expand...

knew it. darned iranians.
thanks for the update, mood.

guest · Dec 14, 2020

mood said: ↑

Iran Suspected After Massive Cyberattack on Israeli Firms Revealed December 13, 2020
Click to expand...

Indications suggest that Iranians are behind a string of cyberattacks on Israeli companies
December 14, 2020
https://www.calcalistech.com/ctech/articles/0,7340,L-3881653,00.html

Is Iran behind a series of cyberattacks against Israeli companies in recent days? Following the attack on Amital Data last week and a string of hacks of shipment and logistics companies that were exposed in Calcalist, on Sunday hackers claimed to have breached the servers of Israeli chip manufacturing company Habana Labs, which was acquired by Intel last year.

Ben David tends to believe that the latest string of hack does not constitute an “official” Iranian attack against Israel, primarily because of the software that was used.
It would be hard to prove that Iran is behind it too since state agencies are good at hiding information.

The fact that it doesn’t appear to be a state-coordinated attack doesn’t rule out the involvement of Iranian hackers.
Click to expand...

At the time of writing, it is not yet clear what it is that the people behind the attacks want, but various assessments, including by cyber companies Security Joe and Profero, ruled that it is not an attempt to blackmail the companies.

“The attack’s goal is to gather intelligence and not to collect a monetary ransom,” they told Calcalist.
Amital said that it has received no ransom demand yet. Other sources in the cyber industry say the companies’ servers had not been encrypted, indicating that the hackers stole the data and did not choose to use it for extortion purposes.
Click to expand...

imdb · Dec 14, 2020

those darned iranians.

https://www.israelnationalnews.com/News/News.aspx/293026

Iranian hackers attack dozens of Israeli sites, demand ransom.
Click to expand...

Israeli cyber security expert explains how Iranian-linked group was able to breach dozens of local firms in the past weeks.
Click to expand...

imdb · Dec 16, 2020

Iranian Hackers Hit 80 Israeli Firms as Massive Cyberattack Continues
Pay2Key, an Iranian ransomware gang, is only active since November but has already managed to wreak havoc on Israeli companies

https://www.haaretz.com/israel-news...ms-as-massive-cyberattack-continues-1.9375486

Recent days have seen reports of at least two serious cyberattacks against Israeli companies. The first targeted Israeli software firm Amital Data and some 40 of its clients, and the second was against Habana Labs, a processor producer working under Intel. The two attacks are being attributed to the Iranian hackers Pay2Key, which is targeting Israeli firms at a rapid and alarming speed. New details of the attack, revealed by OP Innovate, show its scope was much wider than previously known.
Click to expand...

guest · Dec 18, 2020

Pay2Kitten – Fox Kitten 2
December 17, 2020
https://www.clearskysec.com/pay2kitten/

During the past four months a wave of cyber-attacks has been targeting Israeli companies.
We estimate with medium to high confidence that Pay2Key is a new operation conducted by Fox Kitten, an Iranian APT group that began a new wave of attacks in November-December 2020 that entailed dozens of Israeli companies.

We estimate that this campaign is part of the ongoing cyber confrontation between Israel and Iran, with the most recent wave of attacks causing significant damage to some of the affected companies. The entry vector mostly consists of well-known vulnerabilities covered in our Fox Kitten reports throughout the year.
Click to expand...

Analyzing the recent attacks conducted by the threat actor Pay2Key led us to the assessment on the overlaps between Fox Kitten to Pay2Key. In the following chapter, we examine the tool set used by Pay2Key group and compare it to Fox Kitten tool set. In the last chapter of the report, we supply a detailed comparison between the two groups based both on technical and thematic analysis.
Click to expand...

guest · Dec 20, 2020

Iran-linked group claims to hack Israeli defense firm, releases employee data
December 20, 2020
https://www.timesofisrael.com/iran-...-israeli-defense-firm-releases-employee-data/

An Iran-linked hacking group on Sunday claimed to have breached the Israeli Aerospace Industries’ computer systems, in the latest in a series of cyberattacks on Israeli firms.

The group, known as Pay2Key, revealed its alleged hack in a tweet.

“Knock Knock! Tonight is longer than longest night for @ILAerospaceIAI,” the group wrote cryptically.
The hacking group, which has been tied to Iran, also mentioned a systems administrator at the defense contractor’s Elta subsidiary by name, Koby Fiada, revealing his password.
Click to expand...

The alleged hack of the Elta subsidiary came after a major cyberattack earlier this month hit dozens of Israeli logistics companies, with hackers making off with information from servers, according to a report of the incident by one of the victims, Amital Data, filed to the Tel Aviv Stock Exchange.
Iran was believed to be the likely culprit.
Click to expand...

imdb · Dec 20, 2020

mood said: ↑

Iran-linked group claims to hack Israeli defense firm, releases employee data
December 20, 2020
https://www.timesofisrael.com/iran-...-israeli-defense-firm-releases-employee-data/
Click to expand...

this is state-sponsored terror and should be dealt with accordingly and harshly.

imdb · Dec 24, 2020

Iran-linked hackers say they breached Israeli cyber security firm Portnox

https://www.timesofisrael.com/iran-...-breached-israeli-cyber-security-firm-portnox

Pay2Key hacking group leaks documents from leading Israeli companies, latest in series of ransomware attacks tied to outfit researchers have traced to Iran.
Click to expand...

guest · Aug 18, 2021

Iranian Hackers Target Several Israeli Organizations With Supply-Chain Attacks
August 18, 2021
https://thehackernews.com/2021/08/iranian-hackers-target-several-israeli.html

IT and communication companies in Israel were at the center of a supply chain attack campaign spearheaded by an Iranian threat actor that involved impersonating the firms and their HR personnel to target victims with fake job offers in an attempt to penetrate their computers and gain access to the company's clients.

The attacks, which occurred in two waves in May and July 2021, have been linked to a hacker group called Siamesekitten (aka Lyceum or Hexane) that has primarily singled out oil, gas, and telecom providers in the Middle East and in Africa at least since 2018, researchers from ClearSky said in a report published Tuesday.
Click to expand...

Infections undertaken by the adversary commenced with identifying potential victims, who were then enticed with "alluring" job offers in well-known companies like ChipPc and Software AG by posing as human resources department employees from the impersonated firms, only to lead the victims to a phishing website containing weaponized files that unload a backdoor known as Milan to establish connections with a remote server and download a second-stage remote access trojan named DanBot.

ClearSky theorized that the attacks' focus on IT and communication companies suggest they are intended to facilitate supply chain attacks on their clients.
Click to expand...

Clearsky: New Iranian Espionage Campaign By “Siamesekitten” – Lyceum

In July 2021, we detected a second wave of similar attacks against additional companies in Israel. In this wave, Siamesekitten upgraded their backdoor malware to a new version called “Shark” and it replaced the old version of their malware called “Milan”. Details of both versions are included in our report.

This report summarizes our findings regarding the latest Siamesekitten attacks and reviews the attack patterns and malware used in this campaign.
Click to expand...

Log in or Sign up

Israel's supply chain targeted in massive cyberattack

guest Guest

imdb Registered Member

guest Guest

imdb Registered Member

guest Guest

imdb Registered Member

imdb Registered Member

guest Guest

guest Guest

imdb Registered Member

imdb Registered Member

guest Guest

Log in or Sign up

Israel's supply chain targeted in massive cyberattack

guest Guest

imdb Registered Member

guest Guest

imdb Registered Member

guest Guest

imdb Registered Member

imdb Registered Member

guest Guest

guest Guest

imdb Registered Member

imdb Registered Member

guest Guest

Useful Searches