Suspected espionage campaign targets telecoms, IT service firms in Middle East

The activity is focused on targets in Israel, Saudi Arabia and elsewhere.

Hackers targeted a string of telecommunication operators and IT service organizations in the Middle East and Asia over the last six months, according to research published Tuesday.

The suspected espionage activity targeted organizations in Israel, Jordan, Kuwait, Saudi Arabia, the United Arab Emirates, Pakistan, Thailand, and Laos, according to the research from Symantec’s Threat Hunter Team. The “targeting and tactics are consistent with Iranian-sponsored actors,” researchers noted, but stopped short of tying the activity to the Iranian government.

Some of the evidence shows a link to Seedworm — otherwise known as MuddyWater — a prolific hacking group with suspected ties to Iran known for concerted espionage efforts dating back to at least 2015. The group previously threatened to kill security researchers who stumbled across one of its command-and-control servers. Its operators have also focused on academia and the tourism industry in multiple countries earlier this year, and governments and other telecommunications operators over the last several years.

Symantec researchers noted that the latest activity shows attackers relying on a mixture of legitimate remote administration and security assessment tools, publicly available malware, and no apparent use of custom malware. After breaching a network, the attackers typically attempted to steal credentials and move laterally across the network.

Some compromised organizations may have been used as stepping stones to find and target additional victims, while others may have been compromised solely to perform supply-chain type attacks on yet other organizations, according to the researchers.

Two IP addresses from this campaign were previously linked to Seedworm’s activity, but the researchers note the group regularly switches its infrastructure so conclusive attribution was not possible. There was, however, overlap in the tools used in this campaign and previous Seedworm activity, including tools identified by security firm Trend Micro as being associated with the group in March 2021.

If Iranian, the latest activity would fit into a broader pattern of suspected Iranian hacking activity over the past year, which ranges from interference in the 2020 U.S. presidential election to ransomware to possible hack-and-leak operations targeting Israeli citizens.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure