The group of Gaza-based hackers known as “Molerats” has refreshed its toolset with two new backdoors

guest · Dec 10, 2020

Researchers Uncover New Cyber-Espionage Campaign Targeting Middle Eastern Politicians
December 9, 2020
https://www.infosecurity-magazine.com/news/cyber-espionage-campaign-middle/

A new cyber-espionage campaign using popular social media and cloud platforms to target high ranking political figures has been revealed following an investigation by Cybereason.

The campaign has been observed to operate primarily across the Middle East, and the researchers believe it is aimed at high ranking political figures and government officials in the region. Cybereason has attributed the campaign to the politically-motivated APT group Molerats, which has been active in the Middle East since 2012. The threat actors have previously used the Spark and Pierogi backdoors to execute targeted attacks against Palestinian officials.
Click to expand...

The new campaign utilizes three previously unidentified malware variants: two backdoors named SharpStage and Dropbox and a downloader called MoleNet. These are designed to help leverage Facebook, Dropbox, Google Docs and Simplenote for command and control to exfiltrate sensitive data from victims’ computers.
Click to expand...

Cybereason: New Malware Arsenal Abusing Cloud Platforms in Middle East Espionage Campaign

The Cybereason Nocturnus Team has continued tracking the group, and in recent months detected a new campaign leveraging two previously unidentified backdoors dubbed SharpStage, DropBook, as well as a downloader dubbed MoleNet.
Click to expand...

guest · Jun 19, 2021

MoleRATs hacking group continues to target Middle Eastern governments
June 17, 2021
https://www.cyberscoop.com/molerats-gaza-israel-cyber-proofpoint/

The hacking group, known as MoleRATs, sent target organizations a malware-laced PDF claiming to be a report on Hamas members meeting with the Syrian government, security firm Proofpoint said. The malicious code is able to access files and take screenshots on a victim’s computer in furtherance of a spying campaign.

MoleRATs is one of the more opportunistic hacking units in the Middle East, and often seizes on headlines of regional conflict to try to dupe targets into clicking on links.

The latest MoleRATs spearphishing campaign uses an updated version of hacking tool first noticed in December by security firm Cybereason. Then and now, the attackers are using the popular file-sharing platform Dropbox to siphon off data from targets.
Proofpoint declined to reveal the targets of the recent MoleRATs hacking.
Click to expand...

Proofpoint: New TA402 Molerats Malware Targets Governments in the Middle East

Key Findings

TA402 leverages political and military themes, including the ongoing conflict in the Gaza Strip, to entice users to open attachments and click on malicious links.

TA402 activity is largely focused on entities operating in the Middle East, especially government or government-adjacent organizations.

TA402’s custom malware called LastConn is used to gain access to and conduct information gathering activities.

LastConn uses a number of unique features to deter automated threat analysis and make manual analysis difficult.

Click to expand...

Overview
Proofpoint researchers identified a malware called LastConn distributed by TA402, a threat actor also known as Molerats. The malware targeted government institutions in the Middle East and global government organizations associated with geopolitics in the region.

The custom malware implant identified by Proofpoint enables the threat actor to conduct reconnaissance on the target host and exfiltrate data. TA402 leveraged multiple mechanisms to avoid automated threat analysis including geofencing based on IP addresses, only targeting computers with Arabic language packs installed, and password-protected archive files to distribute malware.
Click to expand...

Log in or Sign up

The group of Gaza-based hackers known as “Molerats” has refreshed its toolset with two new backdoors

guest Guest

guest Guest

Log in or Sign up

The group of Gaza-based hackers known as “Molerats” has refreshed its toolset with two new backdoors

guest Guest

guest Guest

Useful Searches