Researchers identify year-long cyberespionage effort against Israelis, Palestinians

IDG News Service - The recent cyberattack that infected Israeli police computers with malware was likely part of a year-long cyberespionage operation with targets in Israel and the Palestinian territories, according to security researchers from antivirus vendor Norman.

At the end of October, the Israeli police shut down its computer network after a piece of malware was found on some of its systems. At the time, that malware was a remote access Trojan (RAT) program called Xtreme RAT and was delivered in an archive attached to a spoofed email claiming to be from Benny Gantz, the chief of general staff of the Israel Defense Forces, according to a report from antivirus vendor Trend Micro.

The RAR archive contained a file called "IDF strikes militants in Gaza Strip following rocket barrage.doc" followed by a long series of hyphens and .scr, Snorre Fagerland, principal security researcher at Norwegian antivirus vendor Norman said Monday in a report.

The .scr file, whose name was crafted to hide its real extension, dropped other files on the system's hard drive when executed: a legitimate Word document that was used as bait, an icon file and an .exe file that was actually the Xtreme RAT installer. The Norman researchers noticed that the .exe file was digitally signed with an untrusted, self-generated Microsoft certificate.

This certificate would not be validated by Windows, but the attackers probably hoped that it would trick people who manually inspected the file or would allow the malware to bypass the detection of some security products, Fagerland said.

This is not a new technique. However, what the attackers didn't realize is that the file's digital signature can be used to track down their previous attacks, since they didn't bother to change the certificate when generating new malicious files, Fagerland said.

Norman researchers searched the company's malware database for executable files signed with the same certificate and found other samples that had been used in similar email-based attacks since May. The contents of the bait documents used in those attacks suggested that the targets were from Israel.

A further analysis of the malware samples revealed that they were predominantly Xtreme RAT variants and connected back to a number of hostnames registered with free dynamic DNS providers. Many of those hostnames pointed to the same IP addresses.

Most of the IP addresses used recently are owned by U.S.-based hosting providers, which suggests that the attackers are hosting their command and control (C&C) servers in the U.S. However, that wasn't always the case.

Until the summer of this year, the hostnames pointed to IP addresses belonging to an ISP from the city of Ramallah in the West Bank, Fagerland said.