Iranian hacker group was suspected to have targeted the European energy sector, is what was thought to be a reconnaissance mission aimed at gathering sensitive information.
In a report by cybersecurity company Recorded Future, the hacker group was said to have used the PupyRAT software which can infiltrate Windows, Linux, OSX and Android. Successful breach would give hackers the ability to access the victim's system, including usernames, passwords and sensitive information across the network the system is connected to.
PupyRAT is an open-source malware, and is available on GitHub. But it has been prominently linked with Iranian state-backed hacking campaigns, particularly by the group known as APT33, and has previously been deployed in attacks targeting several critical infrastructure.
And here, the researchers at Recorded Future said that they've identified the malware as having been used in attacks that took place between November 2019 and January 2020.
What this means, the hackers were on the move just when the tensions raised between the Middle East and the U.S. following the airstrike by the latter that killed the Iranian General Qassem Soleimani.
The researchers were unable to identify the exact method of malware delivery, but suggested that the malware was distributed through spear-phishing attacks.
This thought was based on previous APT33 campaigns, which have involved the hackers in posing as trusted individuals and attempted to gain trust of potential victims before eventually sending a malicious document.
In this attack campaign, the researchers saw a high-volume network traffic from the targeted company in the energy sector, repeatedly communicating with command-and-control infrastructure associated with previous PupyRAT campaigns According to the researchers, this is enough evidence to believe that the network had been compromised in what they believe to be an espionage campaign.
According to Priscilla Moriuchi, director of strategic threat development at Recorded Future:
"Our sense is that given the network activity we're seeing, access to this kind of sensitive information about energy allocation and resourcing would be hugely valuable for adversaries."
Recorded Future has contacted the affected target about the attack.
"There's an assumption you can turn off and turn on network attacks but this usually isn't the case," Moriuchi added. "Enabling operations or destructive attacks takes this type of months-long reconnaissance and insight into the behaviour of officials at these companies and understanding how a certain capability could impact information or distribution of energy resources."
Looking back at previous cyberattacks, energy companies were frequent targets by hackers.
This is because these entities may hold sensitive information, and are crucial infrastructure to wherever they are at.
In another story, Iranian hacker was said to have hacked and defaced several websites in the U.S. to display a photo of the assassinated Iranian General Qassem Soleimani with the message “Down with America.” But unlike the attack campaign tied by the APT33, the deface attempts were said to have been made by a teenager.
The 19-year-old hacker that goes with the name Mr Behzad, said that he is operating out of a sense of patriotism.
“I do not work for the government. I work for my home country of Iran,” he told The Verge, as he added a heart emoji after his country’s name. He said he learned how to deface sites through work programming and coding. “We want to know that if they harm our people or our country, we will not fail.”
The most significant attempt in defacing a website linked to Iran was targeting the Federal Library Depository Program, which was hacked by an entity or group calling itself “Iran Cyber Security Group Hackers”. The hackers displayed a photo of Trump getting punched.
The image shows blood running down Trump's chin as a fist punches him in his left cheek. The fist punching Trump is covered by a green sleeve bearing the insignia of the Islamic Revolutionary Guard Corps, a branch of the Iranian Armed Forces that was led by General Soleimani from 1998 until his death in 2020.
Two golden missiles, each emblazoned with the Iranian flag, shoot across the bottom of the illustration.
"This is message from Islamic Republic Of Iran," reads the text in English, accompanied by pro-Iranian statements, and included photos of Iran’s supreme leader, Ayatollah Ali Khamenei, and the country’s flag.
“We’re always ready,” the text on the graphic said.
According to a spokesperson for the Cybersecurity and Infrastructure Security Agency, a division of the Department of Homeland Security, they are aware of the hack, and said that the cause was “a misconfiguration with the content management system allowed a malicious actor to deface the website.”
