New Wave Of Cyber Attacks Target Palestine With Political Bait And Malware

 

Cybersecurity researchers have turned the spotlight on a new wave of offensive cyberattacks targeting Palestinian activists and entities starting around October 2021 using politically-themed phishing emails and decoy documents.

The intrusions are part of what Cisco Talos calls a longstanding espionage and information theft campaign undertaken by the Arid Viper hacking group using a Delphi-based implant called Micropsia dating all the way back to June 2017.

The threat actor's activities, also tracked under the monikers Desert Falcon and the APT-C-23, were first documented in February 2015 by Kasperksy and subsequently in 2017, when Qihoo 360 disclosed details of cross-platform backdoors developed by the group to strike Palestinian institutions.

The Russian cybersecurity company-branded Arid Viper the "first exclusively Arabic APT group."

Then in April 2021, Meta (formerly Facebook), which pointed out the group's affiliations to the cyber arm of Hamas, said it took steps to boot the adversary off its platform for distributing mobile malware against individuals associated with pro-Fatah groups, the Palestinian government organizations, military and security personnel, and student groups within Palestine.

                                    Decoy document containing text on Palestinian reunification

The raft of new activity relies on the same tactics and document lures used by the group in 2017 and 2019, suggesting a "certain level of success" despite a lack of change in their tooling. More recent decoy files reference themes of Palestinian reunification and sustainable development in the territory that, when opened, lead to the installation of Micropsia on compromised machines.

The backdoor is designed to give the operators an unusual range of control over the infected devices, including the ability to harvest sensitive information and execute commands transmitted from a remote server, such as capturing screenshots, recording the current activity log, and downloading additional payloads.

"Arid Viper is a prime example of groups that aren't very advanced technologically, however, with specific motivations, are becoming more dangerous as they evolve over time and test their tools and procedures on their targets," researchers Asheer Malhotra and Vitor Ventura said.

"These [remote access trojans] can be used to establish long-term access into victim environments and additionally deploy more malware purposed for espionage and stealing information and credentials."

Related posts

1. Hack Tool Apk
2. Nsa Hacker Tools
3. Hacker Tools
4. Hacker Tools Linux
5. Hacker Techniques Tools And Incident Handling
6. Pentest Tools List
7. Hack Website Online Tool
8. Nsa Hack Tools
9. Hacker Tools Mac
10. Pentest Recon Tools
11. Hacking Tools For Beginners
12. Nsa Hack Tools
13. Pentest Tools Kali Linux
14. Best Hacking Tools 2019
15. Hacker Tools Apk Download
16. Hacks And Tools
17. Hacks And Tools
18. Hack Tool Apk
19. Pentest Tools Linux
20. Pentest Tools Alternative
21. Kik Hack Tools
22. Pentest Tools List
23. Hackrf Tools
24. How To Make Hacking Tools
25. Nsa Hack Tools
26. Hack Tools For Mac
27. Hacking Tools Hardware
28. Hack Tools Mac
29. Pentest Tools Download
30. Hack Tools For Games
31. Kik Hack Tools
32. Hack And Tools
33. Best Hacking Tools 2019
34. Free Pentest Tools For Windows
35. Hacking Tools For Kali Linux
36. Hack Website Online Tool
37. Hacking Tools Usb
38. Hack Tools Download
39. Nsa Hack Tools Download
40. Pentest Tools Online
41. Pentest Tools Tcp Port Scanner
42. Easy Hack Tools
43. Android Hack Tools Github
44. Hacking Tools For Windows Free Download
45. Bluetooth Hacking Tools Kali
46. Hacking Tools For Mac
47. Hacker Security Tools
48. Pentest Tools Review
49. Hacking Tools Pc
50. Hack Tools
51. Hacker Tools Free
52. Pentest Automation Tools
53. Hack Tools 2019