Kaspersky finds a new APT campaign targeting engineers in the Middle East

The malware, which is well-suited for spying, doesn’t match any code the researchers have seen before.

A mysterious set of hackers last year began a targeted campaign to breach industrial organizations in the Middle East, antivirus firm Kaspersky said Tuesday.

Attackers have sought to breach engineers, particularly in a single, unnamed Middle Eastern country, adding to a long history of cyber operations in the region. They’re relying on a strain of malicious software that’s tailored for espionage, and does not appear to match any code the researchers have seen before. Exactly who is behind the effort remains unclear.

The sensitivity of the targets, and the fact that the activity is ongoing, prompted the researchers to go public with their findings. The Moscow-based company labeled the activity an “advanced persistent threat” (APT), a loose term for well-resourced hackers often linked to government interests. Kaspersky designated the hacking campaign “WildPressure.”

“Anytime the industrial sector is being targeted, it’s concerning,” said Kaspersky senior security researcher Denis Legezo. There is no indication that hackers have done anything beyond gather information from the compromised networks, he added.

“We made this conclusion [ that it is an APT because] the malware is rare, targets a very specific region, and is suitable for espionage,” Legezo told CyberScoop, “So far we have no data regarding sponsorship.”

Broadly speaking, the “industrial sector” could mean organizations in energy or others domains critical to a society or economy, but Kaspersky researchers did not elaborate on the nature of the organizations targeted.

With a wealth of valuable industrial facilities, the Middle East has long been the scene of hacking operations to spy on or disrupt those facilities. The Stuxnet worm stifled an Iranian nuclear facility a decade ago, while the Trisis malware disrupted a Saudi petrochemical company in 2017.

Whether the WildPressure campaign amounts to anything more than espionage remains to be seen. The hackers were patient in developing their malware, but Legezo said he’s seen more painstaking operations.

“If we compare it with other targeted malware, there are worse ones out there,” he told CyberScoop in an email.

One of the pieces of code unpacked by Kaspersky researchers was labeled “1.0.1,” indicating that an updated version could be in the cards.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure