Fake Website With Ties to Iran’s Regime Targets U.S. Veterans
Written by Staff Writer of the NCRI Official Website on 29 September 2019.
Researchers have unmasked a website masquerading as a job site for U.S. veterans that may have ties to Iran’s regime, Fox News reported on Friday.
Researchers from security firm Cisco Talos reported this week that the website, Hire Military Heroes, was distributing malware that allows hackers to gain control of the victim’s computer.
An interesting twist is that the hackers may also be targeting active servicemen and not just veterans, according to ZDNet, which cites that Iran’s regime may be behind the attack.
A cyber-security analyst from the U.S. Department of Homeland Security, speaking on background, told ZDNet that the attackers are aiming at military networks
“They [the hackers] are hoping that one of their targets would use a DOD system to download and run the malware,” the analyst told the news outlet. “Chances are low, but it’s worth a shot…Pretty clever approach, if I can say so,” the analyst added, referring to the Department of Defense.
The bad actor had been previously identified by Symantec as Tortoiseshell, a group behind a previous attack on an IT provider in Saudi Arabia, according to Cisco Talos.
The fake veterans website has three links to download a desktop app for free — but the app is actually a fake installer. When the fake installer starts, the progress bar almost fills up entirely and then displays an error message.
“The installer checks if Google is reachable. If not, the installation stops. If it is reachable, the installer downloads two binaries [files],” according to Cisco Talos.
One of the binary files is used to perform “reconnaissance” on the system and the second is the Remote Administrative Tool.
“The attacker retrieves information such as the date, time and drivers,” Cisco Talos researchers wrote in the report. “The attacker can then see information on the system, the patch level, the number of processors, the network configuration, the hardware, firmware versions, the domain controller, the name of the admin, the list of the account, etc. This is a significant amount of information relating to a machine and makes the attacker well-prepared to carry out additional attacks.”
Both the amount and the kind of information that is targeted makes the attacks particularly dangerous, Warren Mercer, a researcher at Cisco Talos, told Fox News.
“When you focus on the agenda of the attackers, it’s unlikely to be a garden variety attack…they certainly wanted something much more meaningful than your cat pictures,” Mercer said.
Mercer added that it’s difficult to assess the effectiveness of this attack since it was discovered before the operation went into high gear. “We did not identify any ‘in-the-wild’ activity associated and since our publication, the threat actor’s website is now unavailable.”
Originally published at http://freedomstarblog.wordpress.com on September 30, 2019.