Kaspersky uncovers sophisticated cyber-espionage operation across Africa and Middle East

Kaspersky says the threat is likely the work of a nation-state.

Researchers have uncovered new malware that has apparently been used to spy on victims in the Middle East and Africa for six years undetected.

A report from Moscow-based Kaspersky Lab details how a threat it’s calling “Slingshot” has been infecting victims, collecting a wide variety of data and exfiltrating it in a covert fashion. The company says the threat is likely the work of a resource-rich government.

“Slingshot is very complex and the developers behind it have clearly spent a great deal of time and money on its creation. Its infection vector is remarkable – and, to the best of our knowledge, unique,” the researchers write in the report, released Friday.

Kaspersky says the APT has been active as far back as 2012 and was still active as of February this year. Slingshot is apparently so sophisticated that Kaspersky has labeled it an advanced persistent threat (APT).

The researchers say that Slingshot’s infection vector for most victims is unknown, but that in some cases the attackers gained access to and deployed the malware through routers manufactured by MikroTik, a Latvian company. In those cases, the victims unknowingly download a dynamic link library (DLL) from the router that was placed by the APT. From there, the DLL continues to download other malicious components.

Notably, the Slingshot malware framework can gain control of computers at the kernel level, giving the group complete control of a victim’s device. It does this by loading vulnerable drivers into the computer and running its own code through the router vulnerabilities, Kaspersky researchers say.

Having kernel access means Slingshot can collect whatever information it wants. Kaspersky analysis shows that the malware is configured to collect a wide swath of data from victims’ computers, including screenshots, keystrokes, networking information, user passwords, USB connection and clipboard information, among other things.

Another unique trait to Slingshot is how stealthy it is. It employs techniques to bypasses security products, and it encrypts all strings — the individual command lines — in its modules. Slingshot also has the ability to make sure its components can finish their tasks before the system is shut down, which Kaspersky says is probably to avoid detection in the case of a technical computer forensic investigation.

So far, the researchers say they have identified at least 100 victims, for the most part based in Kenya and Yemen, as well as Afghanistan, Libya, Democratic Republic of Congo, Jordan, Turkey, Iraq, Sudan, the United Arab Emirates, Mauritius, Somalia and Tanzania. Nearly all of these countries have been involved in recent years with Western governments on foreign counterterrorism efforts.

There are some limited hints that suggest SlingShot may be connected to another APT group, the Equation Group, which is widely believed to be associated with the U.S. government. Code overlaps between past Equation Group-linked activity shows a relationship could exist, although the evidence is far from conclusive.

Even so, Kaspersky researchers say they aren’t able to attribute Slingshot to an already known threat group. But text within Slingshot’s code is written in perfect English, with apparent references to J. R. R. Tolkien’s Lord of the Rings. Kaspersky says in a press release that Slingshot’s sophistication suggests that the attackers behind it are “professional and probably state-sponsored.”

“The malware is highly advanced, solving all sort of problems from a technical perspective and often in a very elegant way, combining older and newer components in a thoroughly thought-through, long-term operation, something to expect from a top-notch well-resourced actor,” the researchers write. “All this framework is designed for flexibility, reliability and to avoid detection, which explains why these components were not found for more than six years.”

Kaspersky’s visibility into Slingshot’s worldwide impact is limited and so it’s likely that they’re only aware of a subset of the group’s wider activity. There may also be attack vectors aside from MikroTik routers. Kaspersky says it has given MikroTik all its information and that MikroTik’s software no longer downloads anything from the users’ routers to their computers.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure