How Hackers Plant False Flags to Hide Their Real Identities:
During the first half of 2015, a mysterious hacking group allegedly started attacking military and government organizations in Peru in what looked like a routine—even run-of-the-mill—espionage campaign.
The group used an old exploit and “clunky” malware, nothing particularly notable. What was unusual about this operation was that the malware was signed with a stolen digital certificate that had already been used by the hackers responsible for disrupting an Iranian nuclear power plant in the famous Stuxnet attack, according to security firm Kaspersky Lab.
All this made very little sense.
The use of the stolen certificate made it look like the hacking group was the same as the Stuxnet attack, or was it just a trick? Security experts often repeat a mantra: “attribution is hard.” Finding out who is responsible for a cyberattack is a complicated, often impossible task, and in some cases, hackers make it even harder by leaving misleading clues, like in the case of the Peruvian attacks.
Source: Vice Magazine
Fake EFF site serving espionage malware was likely active for 3+ weeks:
A spear-phishing campaign some researchers say is linked to the Russian government masqueraded as the Electronic Frontier Foundation in an attempt to infect targets with malware that collects passwords and other sensitive data.
The targeted e-mails, which link to the fraudulent domain electronicfrontierfoundation.org, appear to be part of a larger campaign known as Pawn Storm. Last October, researchers at security firm Trend Micro brought the campaign to light and said it was targeting US military, embassy, and defense contractor personnel, dissidents of the Russian government, and international media organizations. Last month, Trend Micro said the espionage malware campaign entered a new phase by exploiting what then was a zero-day vulnerability in Oracle’s widely used Java browser plugin. Separate security firm FireEye has said the group behind the attacks has ties to Russia’s government and has been active since at least 2007.
Source: Ars Technica
When Canada Learned It Had Spies:
“The government had constantly denied that Canada was involved in spying or espionage,” Macadam said in one of a series of phone interviews. “I thought it was important to find out if we were.”
If only he had known the depths of the rabbit hole he was about to enter.
Source: Vice Magazine