Russian Threat Group May Have Devised a 'Man-on-the-Side' Attack

guest · Jul 25, 2019

Russian Threat Group May Have Devised a 'Man-on-the-Side' Attack
Data from an intrusion last year suggests Iron Liberty group may have a new trick up its sleeve, Secureworks says
July 25, 2019
https://www.darkreading.com/attacks...ised-a-man-on-the-side-attack-/d/d-id/1335348

Iron Liberty, a Russia-based cyber espionage group known for targeting energy, nuclear, and defense organizations worldwide, may have developed a dangerous new technique called a "man-on-the side" attack.
Secureworks warned about the new threat in a report this week describing a "man-on-the-side" (MOTS) attack to install malware.

"With MOTS, the attacker has sufficient access to observe and inject traffic which through timing/bandwidth is consumed by the victim before the legitimate reply arrives."
The security vendor's theory is based on its analysis of a campaign last year where Iron Liberty actors managed to install a malware tool called Karagany on a target system without leaving any trace of how they did it. According to Secureworks, its research showed no evidence of a phishing email, drive-by-download, or a malicious link being used to drop the malware on the system.

Secureworks' forensic analysis showed that Karagany was installed on the system shortly after its user initiated a legitimate request to download Adobe Flash over HTTP from Adobe's official website [...] Instead, they believe the Iron Liberty actors likely managed to compromise a router outside the victim organization, and then used it to intercept the Adobe installer request and return a Trojanized response, Secureworks said.
Click to expand...

Secureworks: Own The Router, Own The Traffic

Log in or Sign up

Russian Threat Group May Have Devised a 'Man-on-the-Side' Attack

guest Guest

Log in or Sign up

Russian Threat Group May Have Devised a 'Man-on-the-Side' Attack

guest Guest

Useful Searches