Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

8/1/2019
11:15 AM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Threat Actors Muddy Waters in Middle East with APT Hijacks, Fake Leaks in Q2 2019

Woburn, MA – August 1, 2019 – According to Kaspersky’s quarterly APT trends summary, advanced persistent threat (APT) activity in Q2 2019 included a number of attacks targeting or originating in the Middle East and South Korea. While the goal for many of these threats was focused on cyberespionage or financial gain, one campaign trend varied from the rest with the purpose of spreading misinformation.

Kaspersky’s APT trends summary is compiled using information from various resources including Kaspersky’s private threat intelligence research to highlight the main developments that researchers believe the public should be aware of. In the second half of 2019, Kaspersky researchers observed interesting activity in the Middle East including a series of online asset leaks such as code, infrastructure, group and apparent victim details, allegedly belonging to known Persian-speaking threat actors, OilRig and MuddyWater. Though these leaks originated from different sources, they all appeared within a few weeks of each other. The third online leak, which was said to expose information related to an entity called the “RANA institute,” was published in Persian on a website called “Hidden Reality.”

Kaspersky researchers’ analysis of the materials, infrastructure and the dedicated website led to the conclusion that this particular leak could be connected to the threat actor, Hades. Hades is the well-known cyber threat group behind the OlympicDestroyer incident targeting the 2018 Winter Olympic Games, as well as the ExPetr worm and other various disinformation campaigns including the 2017 leak of emails relating to Emmanuel Macron’s presidential election campaign in France.

Additional APT highlights in Q2 2019 include:

  • Russian-speaking groups continue to consistently refine and release new tools and launch new operations. Since March, Zebrocy appears to have turned its attention towards events, officials and related diplomats and military in Pakistan and India as well as maintaining ongoing access to local and remote Central Asian government networks. Turla’s attacks continue to feature a rapidly evolving toolset such as the apparent hijacking of infrastructure belonging to OilRig.
  • Korean-related activity remained high while the rest of South East Asia saw less activity than in previous quarters. Notable operations include an attack by the Lazarus group targeting a mobile gaming company in South Korea and a campaign by BlueNoroff, a Lazarus sub-group, targeting a bank located in Bangladesh and crypto-currency software.
  • Researchers also observed an active campaign targeting government bodies in Central Asia by Chinese-speaking APT group SixLittleMonkeys using a new version of the Microcin Trojan and a RAT that Kaspersky calls HawkEye as a last stager. 

The second quarter of 2019 shows just how clouded and confusing the threat landscape has become, and how often something is not what it seems,” said Vicente Diaz, principal security researcher, Global Research and Analysis Team, Kaspersky. “We saw a threat actor hijacking the infrastructure of a smaller group and another group possibly capitalizing on a series of online leaks to spread disinformation and undermine the credibility of exposed assets. The security industry faces an ever-growing task to cut through the smoke and mirrors to find the facts and threat intelligence that cybersecurity relies on. As always, it is important to add that that our visibility is not complete, and there will be activity that is not yet on our radar or not fully understood, so protection against both known and unknown threats remains vital for everyone.”

The APT trends report for Q2 summarizes the findings of Kaspersky’s subscriber-only threat intelligence reports, which also includes Indicators of Compromise (IOC) data and YARA rules to assist in forensics and malware-hunting. For more information, please contact: [email protected]

Read the full APT Q2 2019 trends report on Securelist.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Lessons from the NSA: Know Your Assets
Robert Lemos, Contributing Writer,  12/12/2019
4 Tips to Run Fast in the Face of Digital Transformation
Shane Buckley, President & Chief Operating Officer, Gigamon,  12/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5252
PUBLISHED: 2019-12-14
There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficient authentication in a rare condition. Successful exploit could allow the attacker to use the application locked by applock in an instant.
CVE-2019-5235
PUBLISHED: 2019-12-14
Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal.
CVE-2019-5264
PUBLISHED: 2019-12-13
There is an information disclosure vulnerability in certain Huawei smartphones (Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;Honor 9 Lite;Honor 9i;Mate 9). The software does not properly handle certain information of applications locked by applock in a rare condition...
CVE-2019-5277
PUBLISHED: 2019-12-13
Huawei CloudUSM-EUA V600R006C10;V600R019C00 have an information leak vulnerability. Due to improper configuration, the attacker may cause information leak by successful exploitation.
CVE-2019-5254
PUBLISHED: 2019-12-13
Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981) have an out-of-bounds read vulnerability. An attacker who logs in to the board m...