Mobile Spy Program Target: Oil Industry

Thursday, December 11, 2014 @ 05:12 PM gHale

A cyber-espionage campaign thought to be the next step in the Red October operation appears to be targeting, among others, oil industry users of Android, iOS and BlackBerry mobile devices through spear-phishing attacks.

The campaign uses a complex infrastructure relying on “a convoluted network of router proxies and rented hosts, most likely compromised because of poor configurations or default credentials,” to deliver targeted malicious emails, said researchers at security and network solutions provider Blue Coat.

RELATED STORIES
Surveillance Malware Hides as Legit Software
Details Emerge on Espionage Campaign
Updated Malware Boosts Espionage Tool
Espionage Program 10 Years Old

Because of this, they named the campaign “The Inception Framework,” a reference to Christopher Nolan’s Inception movie starring Leonardo DiCaprio.

Another security firm analyzed the malware used in this operation who called the malware Cloud Atlas and identified plenty of similarities to the toolset used in the Red October campaign, said researchers at Kaspersky Lab.

“The interests of CloudAtlas attackers match those of RedOctober, taking into account the geopolitical changes from the last 2 years,” said Costin Raiu, director of global research and analysis team (GReAT) at Kaspersky Lab.

In an extensive report on Inception/Cloud Atlas, Blue Coat revealed the bad guys planned attacks on mobile devices of high-profile targets in different sectors, from finance and oil industry to military, engineering and politics, in different parts of the world.

The researchers found the attackers were able to use the Bit.ly URL shortening service to create links pointing to machines serving malicious payloads for the mobile devices.

From one account alone, about 10,000 such links ended up created, all leading to only three IP addresses, with a pattern that included a target identifier and an action code for serving malware guised as an app update (WhatsApp or Viber) or MMS phishing.

In the case of phishing, the action code also identified the mobile carrier for the device in order to deliver the appropriate telecom company logo.

Blue Coat said they were not able to get all the data on the targeted mobile operators because the attackers took the servers offline.

“We managed to get 66 of a total of 190,” which accounts for 35 percent, after going through 3152 of 4781 phishing links, the report said. According to the intelligence they collected, it appears that the top three operators were Vodafone, T-Mobile, and Proximus (Belgacom).

Analyzing the malicious updates, Blue Coat found the main feature of the Android version of the malware was to record phone calls, but it can also track location, read contact list, monitor incoming/outgoing calls or text messages.

The attackers used LiveJournal accounts to store the information and communication with the compromised device.

On iOS, researchers found the fake update impersonated a Cydia installer, which could be add on to jailbroken devices.

The data would end up exfiltrated to an FTP account on a hosting service in the UK, and included device and system information, address book, phone number, name of the carrier, WiFi status, MAC address, battery level, total and free space, time zone (default and local), Apple ID, list of downloaded apps, and computer used for creating a backup.

On the BlackBerry platform, a similar set of details as in the case of iOS ended up retrieved and delivered to a DynDNS domain in a U.S.-based webhosting service.

Important to note is the command and control servers are different for each platform. In the case of desktop computers, the attackers relied on Swedish cloud storage service CloudMe to store the stolen data and to deliver new modules to the compromised system.



Leave a Reply

You must be logged in to post a comment.