MoleRATs APT group targets Palestinian territories

guest · Feb 13, 2020

MoleRATs APT group targets Palestinian territories
February 13, 2020
https://securityaffairs.co/wordpress/97791/apt/molerats-apt-campaigns.html

Experts from the Cybereason Nocturnus team have uncovered a cyber espionage campaign allegedly carried out by one of the Gaza Cybergang groups (aka MoleRATs).

MoleRATs is an Arabic-speaking, politically motivated group of hackers that has been active since 2012, in 2018 monitoring of the group, Kaspersky identified different techniques utilized by very similar attackers in the MENA region. Kaspersky distinguished the following three attack groups operating under Gaza Cybergang umbrella: [...]

As part of the last campaign spotted by Cybereason, MoleRATs has been attempting to infiltrate the systems of both organizations and individuals.
Click to expand...

The first campaign dubbed the Spark Campaign employs social engineering to infect victims with the Spark backdoor. Most of the victims were from the Palestinian territories.
According to the experts, the Spark backdoor was specifically designed my MoleRATs to gather system information on an infected machine.

“This backdoor first emerged in January 2019 and has been continuously active since then. The campaign’s lure content revolves around recent geopolitical events, espeically the Israeli-Palestinian conflict, the assassination of Qasem Soleimani, and the ongoing conflict between Hamas and Fatah Palestinian movements.” states the report from Cybereason.

The second campaign was tracked by the experts as the Pierogi Campaign, it employes social engineering attacks to trick victims into installing an undocumented backdoor dubbed Pierogi.

“This backdoor first emerged in December 2019, and was discovered by Cybereason. In this campaign, the attackers use different TTPs and decoy documents reminiscent of previous campaigns by MoleRATs involving the Micropsia and Kaperagent malware.” states the report.
The name ‘Pierogi’ comes after an Eastern European dish, it is a simple Delphi backdoor that was allegedly created by Ukranian-speaking hackers.
Click to expand...

Cybereason:
New Cyber Espionage Campaigns Targeting Palestinians - Part 1: The Spark Campaign
New Cyber Espionage Campaigns Targeting Palestinians - Part 2: The Discovery of the New, Mysterious Pierogi Backdoor

guest · Mar 5, 2020

Hacking Group “Molerats” Targets the Governments of Six Countries
March 4, 2020
https://www.technadu.com/hacking-group-molerats-targets-governments-of-six-countries/94354/

According to a report by Unit 42 researchers, the Gaza-based hacking group known as “Molerats” has been targeting organizations and governments in six countries since at least October 2019. The targets of the hackers are governmental entities, telecommunication providers, firms active in the fields of insurance and retail, and more.

While the attacks are widespread and lengthy, the researchers report that they are not very successful because the actors do not use very sophisticated social engineering practices or even industry-specific themes. This creates confusion around what their real purpose is, as Molerats is a lot more capable than what they’re demonstrating in this campaign.
The attacks begin with a phishing email, which is accompanied by a password-protected Microsoft Word document.
If launched, it plants the Spark backdoor onto the victim’s system.

The countries that were in the crosshair of Molerats are the United States (insurance and retail), Spain (government), United Kingdom (government), the United Arab Emirates (government), and Djibouti (telecom).
Click to expand...

Palo Alto Networks - Unit42: Molerats Delivers Spark Backdoor to Government and Telecommunications Organizations

Log in or Sign up

MoleRATs APT group targets Palestinian territories

guest Guest

guest Guest

Log in or Sign up

MoleRATs APT group targets Palestinian territories

guest Guest

guest Guest

Useful Searches