Nation-sponsored hackers likely carried out hostile takeover of rival groups’s servers

guest · Jun 20, 2019

Nation-sponsored hackers likely carried out hostile takeover of rival groups’s servers
Like an episode of Spy vs. Spy, Russian-speaking Turla appears to hijack OilRig's network
June 20, 2019
https://arstechnica.com/information...sored-hackers-attacked-rival-espionage-group/

Now, researchers with security firm Symantec have uncovered evidence of Turla doing something that would be a first for any nation-sponsored hacking group. Turla, Symantec believes, conducted a hostile takeover of an attack platform belonging to a competing hacking group called OilRig, which researchers at FireEye and other firms have linked to the Iranian government.

Symantec suspects Turla then used the hijacked network to attack a Middle Eastern government OilRig had already penetrated. Not only would the breach of OilRig be an unprecedented hacking coup, it would also promise to make the already formidable job of attribution [...] considerably harder.

The hijacking would be only one of Turla’s impressive accomplishments of late. Over the past 18 months, Symantec has observed Tula rolling out a suite of new custom hacking tools [...] many of the new tools adopt an approach known as “living off the land,” in which tools run in memory and are based on legitimate administrative tools.
Click to expand...

Symantec: Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments

The Waterbug espionage group (aka Turla) [...]
Three waves of attacks
Recent Waterbug activity can be divided into three distinct campaigns, characterized by differing toolsets. One campaign involved a new and previously unseen backdoor called Neptun Backdoor.Whisperer).

A second campaign used Meterpreter, a publicly available backdoor along with two custom loaders, a custom backdoor called photobased.dll, and a custom Remote Procedure Call (RPC) backdoor.

The third campaign deployed a different custom RPC backdoor to that used in the second campaign. This backdoor used code derived from the publicly available PowerShellRunner tool to execute PowerShell scripts without using powershell.exe. This tool is designed to bypass detection aimed at identifying malicious PowerShell usage.
Click to expand...

Log in or Sign up

Nation-sponsored hackers likely carried out hostile takeover of rival groups’s servers

guest Guest

Log in or Sign up

Nation-sponsored hackers likely carried out hostile takeover of rival groups’s servers

guest Guest

Useful Searches