Molerats Go After Governments, US Financial Institution

Cyber espionage does not just happen between China and the United States. Molerats, a hacking group based in the Middle East, is also at work. FireEye has found that the group is using a newer remote access tool (RAT) and aiming at several government entities and one US financial institution.

Between April 29 and May 27 FireEye saw Molerats using Xtreme, a freeware RAT in use by a wide variety of actors. They are disseminating the malware mainly through spear-phishing messages that contain decoy documents that focus on active conflicts in the Middle East. They are also using forged certificates, claiming to be from Microsoft, Kaspersky, or Authenticode.

Targets of this particular set of attacks include Palestinian and Israeli surveillance targets; government departments in Israel, Turkey, Slovenia, Macedonia, New Zealand, Latvia, the US, and the UK; the BBC; and an unnamed major US financial institution.

Although Molerats has used other freeware before -- including Poison Ivy, Cybergate, and Bifrost -- these techniques are consistent with Molerats' activity since as early as October 2011.

"We haven't seen a lot of evolution in their tactics," says Ned Moran, senior intelligence analyst at FireEye, noting that the attackers haven't changed much despite knowing that security companies are aware of them. "It's interesting. It makes my job easier.

"It's possible they're not well-resourced," says Moran, in reference to their use of freeware. "Or they don't want to develop a customized tool that will fingerprint them. When there's a higher signal-to-noise ratio it's harder to identify the source."

The FireEye blog from yesterday (not written by Moran), however does point out some ways that Molerats are tweaking their habits:

The port 443 callback listed in the last sample is also not using actual SSL, but instead, the sample transmits communications in clear-text – a common tactic employed by adversaries to try and bypass firewall/proxy rules applying to communications over traditional web ports. These tactics... seem to indicate that Molerats are not only aware of security researchers’ efforts in trying to track them but are also attempting to avoid using any obvious, repeating patterns that could be used to more easily track endpoints infected with their malware.

The blog also speculates that Molerats might be trying to convince victims that the attacks are deriving from China. Although the decoy documents are all written in Arabic or English, some of the messages and documents contain some Chinese characters.

"I'm not convinced it's an effort to make them look Chinese," says Moran, who believes the presence of Chinese characters is due to the fact that they're borrowing shared attack tools. "I think in this case it's purely coincidental."

It is not clear whether or not Molerats is state-sponsored. The group probably has few resources, and the Middle East is comparatively new to the cybercrime arena, which could explain the fact that its techniques aren't all that sophisticated yet.

It is also not clear what Molerats' end game is, but the nature of the targets leads Moran to believe that they are seeking out "strategic intelligence," instead of money or intellectual property. (The FireEye researchers have asked themselves what is unique about the particular financial institution targeted in this latest series of attacks that would connect it to the other targeted organizations, but they don't have an answer for that yet.)

"The main theme we're trying to get across is that cyber espionage has been democratized," says Moran. "Everyone's doing it now... It could be the big boys. Or it could be the kids next door."