Cyber
The Next Frontier

A hacking campaign displaying what researchers say is some of the most advanced publicly known tradecraft targeting Israel in recent years is showing signs of active development and evolution, a troubling development that has so far blended into the noise of near constant cyber operations targeting Israel.

There’s been no shortage of cyberattacks of varying severity targeting Israeli institutions, particularly in the wake of Hamas’ Oct. 7 attack, but the tradecraft and capabilities displayed by the so-far unattributed group is far more sophisticated, said Nicole Fishbein, a researcher with Intezer.

Dubbed “WildCard,” the group in question appears to be linked to a nearly year-long attack targeting the Israel Electric Corporation, which is Israel’s largest electrical supplier, between April 2016 and February 2017 that researchers at the time called “Electric Powder.”

In January 2022, Fishbein’s firm identified a piece of malware called “SysJoker” that impressed the researchers by its quality development, both in C++ and a multi-platform toolkit, which Fishbein explained is “highly unusual for threat actors in the Middle East scene, especially the kinds of actors we normally see attacking Israel.”

The group’s techniques, tactics and procedures are “unusually mature for the Israeli threat landscape,” she said.

In an analysis published Monday and shared exclusively with CyberScoop, Intezer revealed that over the course of 2022 and 2023 WildCard deployed new malware similar to SysJoker and developed a version in the Rust programming language, which experts say can aid in efficiency, cross-platform performance and avoiding detection.

“As we discovered their new operations, we realized that they’d pushed these development capabilities even further, adopting Rust as their new programming language and re-implementing previously reported functionalities,” Fishbein said.

Fishbein added that WildCard appears to be masking its components as legitimate web development packages and that the group may be delivering these components to Israeli developers using trojanized applications spread through social engineering campaigns.

Following Hamas’s Oct. 7 attack on Israel and amid the subsequent fighting, hacking groups have targeted with Israel with a variety of operations, but these have consisted mostly of distributed denial-of-service attacks, the posting of hacked data, and improvised claims of exaggerated access to water treatment facilities and other critical infrastructure from some Iranian-backed cyber groups, experts have said.

Nonetheless, senior Israeli officials have said they’re worried about cyber escalations as the conflict drags on, particularly from the Iranian-linked hacking groups.

Given its sophistication, WildCard appears to be linked to nation state, but it remains unattributed. According to Intezer’s analysis, the group has targeted Israel for at least 8 years, meaning that its operations are not directly linked to the current round of fighting though it continued targeting Israel after the attacks of Oct 7.

A plethora of hacking groups, some with ties to Iran, Hezbollah or Hamas, have been active in the region for years and have been tracked by government agencies and industry experts under names such as Arid Viper, Gaza Cyber Gang (Molerats), Plaid Rain, and more. Check Point, an Israeli cybersecurity firm, said it has also been tracking the updated versions of SysJoker and said it has been “utilized by a Hamas-affiliated APT to target Israel.”

Fishbein cautioned against concluding that WildCard is a Hamas- or Hezbollah-affiliated operation. “The development capabilities are much better than what we’ve seen with Hamas or Hezbollah affiliated threat actors so far,” Fishbein said.

Researchers have speculated that the Electric Powder attacks to which WildCard is linked were the work of Molerats — a seasoned and effective Palestinian-aligned hacking operation — but Fishbein sees WildCard as a cut above. “What we see now with the WildCard [advanced persistent threat] is a threat actor whose malware development capabilities far exceed those clusters,” she said

Juan Andrés Guerrero-Saade, Associate Vice President of SentinelLabs, SentinelOne’s threat research group, told CyberScoop that what’s known about WildCard suggests a distinct group with outsized capabilities.

“I don’t know of many threat actors doing multi platform C++ dev (and now Rust) in that region,” he said in an online chat. “If their connection with Electric Powder proves out then that’s huge,” he added, calling WildCard an “asymmetrical threat with a greater development capability and interest in critical infrastructure.”

During the Electric Powder campaign, which lasted from April 2016 to at least February 2017, attackers spread malware “via fake Facebook profiles and pages, breached websites, self-hosted and cloud based websites,” researchers with ClearkSky wrote in March 2017. The campaign targeted the Israel Electric Company, which at the time provided roughly 75% of the country’s electrical production capacity.

Guerrero-Saade said that on the scale of threats facing Israel, “this is definitely up there. We aren’t seeing them leak what they’re getting,” he said, and noted that the Electric Powder attack was “extremely worrying.”

Fishbein said WildCard is “definitely operating at a more advanced level than the usual threat actors that focus exclusively on Israel,” and that the group, in particular, needs more attention.

“WildCard has been insistent in focusing on Israel for nearly 8 years with intrusions aimed at strategic sectors, without a clear affiliation to a nation-state, and without announcing their successes like low-end hacktivists groups would,” she added. “Their professionalism and intent make them more concerning than the average threat to Israel.”

The post Shadowy hacking group targeting Israel shows outsized capabilities appeared first on CyberScoop.

Earlier this month, the American defense giant Boeing joined one of corporate America’s fastest growing clubs: firms who have been breached by a new generation of increasingly brazen cybercriminals.

Last week, the hacking crew calling itself LockBit posted posted roughly 43 gigabytes of company data belonging to Boeing’s parts and distribution businesses, but that was just one of a string of breaches affecting major U.S. corporations — firms that in theory should have fairly mature defenses — carried out by hackers linked to the cybercriminal underground known as the Com, ALPHV, LockBit and Lapsus$.

Among their victims are Boeing, Clorox, Caesars Entertainment, Microsoft, MGM Resorts, Nvidia, Samsung, Okta and the Industrial and Commercial Bank of China (ICBC).

Claiming victim after victim in the American corporate landscape, these hacking groups are managing to breach well resourced corporations nearly at will, stealing data, extorting victims and shaming them along the way.

“It’s kind of like a lightning strike in the sense that if they want to go after you, they’ll probably have a fair bit of success, for most companies,” said Tom Uren, formerly of the Australian Signals Directorate and a current editor with Seriously Risky Business cybersecurity news. “It’s just whether they happen to have you in their sights.”

On Tuesday, the Cybersecurity and Infrastructure Security Agency, the FBI and Australia’s signals intelligence agency released an advisory drafted with Boeing’s input describing how LockBit was able to penetrate the defense contractor.

According to the advisory, LockBit affiliates exploited a Citrix vulnerability tracked as CVE-2023-4966 and “Citrix Bleed” that was was first exploited in the wild in August, according to Mandiant. That vulnerability has been widely exploited by multiple ransomware groups to target a major law firm, a major Australian shipping company and was used to breach ICBC, according to the researcher Kevin Beaumont.

The breach of ICBC resulted in disruptions of the U.S. Treasury market, a linchpin of the global financial system.

Citrix disclosed the vulnerability on Oct. 10 and issued patches shortly after, but the vulnerability continues to be exploited. CISA has notified nearly 300 organizations that are potentially vulnerable to the exploit, a senior CISA official said Tuesday, although there are likely additional vulnerable organizations.

According to data collected by GreyNoise, a company that tracks malicious activity online, there are nearly 360 active hosts potentially working to exploit the vulnerability as of Tuesday.

The failure to patch widespread vulnerabilities like these have created a lucrative cybercriminal landscape for groups like LockBit, which refers to the collective name for the ransomware variant, the group that develops and maintains it, and their affiliates. The group has carried out more than 1,400 attacks against victims in the U.S. and around the world since January 2020, a senior FBI official said Tuesday, making at least $100 million in ransom demands and collecting ransom payments in the tens of millions from victims.

In the absence of law enforcement actions against these criminal hackers, there is little reason to believe these attacks will let up any time soon. The FBI has taken “some actions to date specifically against LockBit and continue to pursue enforcement opportunities when and where we can take them,” the senior FBI official said.

Cybersecurity experts for years have advised companies to follow basic cybersecurity hygiene protocols, and the situation has improved, experts say. But the major successes of LockBit and others of late show that there’s still a long way to go with the basics — such as patching vulnerable software and systems.

“The controls that most organizations have in place to protect their data, such as [data loss prevention], seem to be failing with serious consequences,” said Allan Liska, an intelligence analyst with Recorded Future. “But, it is not just data within an organization’s network that is of concern. Ransomware groups are able to pull data from your cloud, your vendors’ clouds, your vendors’ vendors’ clouds and so on.”

Organizations need to better improve their monitoring and controlling the entire data supply chain, he said, because “the ransomware groups don’t care where they get your data from they just care that they have it and can use it to extort you.”

Even as companies have improved their defenses, a spate of recent high profile attacks have social engineering attacks that modern security systems are struggling to prevent. These attacks involve calls to things like IT help desks, where individuals who control access to a system or network are convinced over the phone to give up credentials.

A recent report from Coveware, a firm specializing in cyber extortion incident response, noted IT help desks are designed to solve problems for customers quickly and that this is creating an easy way in for attackers.

“In several of the cases we studied, it was clear that the IT support team’s incentives (speed to resolution) abetted the social engineering,” Coveware wrote. “This is not an easy problem to solve, but we commend the enterprises that have mitigated the risks. These fixes meant increased costs and a mild deprecation to the employee stakeholder experience, for the sake of security.”

Jon DiMaggio, the chief security strategist with Analyst1 who has written extensively on the internal workings of LockBit, said that while there are only a few groups with the “skill and talent and creative ability to do some of these more advanced attacks,” these crews, particularly those associated with the AlphV attacks, are becoming much better at social engineering.

Many major companies still have problems with the cybersecurity basics, DiMaggio said, let alone building help desks that are tough to manipulate. “It’s tough, but they have to change,” DiMaggio said. “Trying to focus on helping people and helping your clients can’t always be number one anymore.”

That might slow response times, he noted, but that’s “a lot better than having to lose ungodly amounts of money, having your reputation destroyed and everything else.”

The post Ransomware groups rack up victims among corporate America appeared first on CyberScoop.