Middle Eastern hacking group is using FinFisher malware to conduct international espionage

The discovery by Kaspersky Lab marks at least the fifth zero-day exploit used by the so-called BlackOasis group and exposed by security researchers since June 2015.

A well-funded, highly active group of Middle Eastern hackers was caught, yet again, using a lucrative zero-day exploit in the wild to break into computers and infect them with powerful spyware developed by an infamous cyberweapons dealer named Gamma Group.

The incident, as described by security researchers with Moscow-based cybersecurity firm Kaspersky Lab, shines a rare light on the opaque although apparently vibrant market for software exploits and spyware, which in this case appears to have been purchased by a nation-state.

The Middle Eastern hacker group in this case is codenamed “BlackOasis.” Kaspersky found the group was exploiting a Adobe Flash Player zero-day vulnerability (CVE-2016-4117) to remotely deliver the latest version of “FinSpy” malware, according to a new blog post published Monday. Adobe issued a fix Monday to its users in the form of a software update.

FinSpy, a final-stage payload that allows for an attacker to covertly learn what a target is talking about and who they are communicating with, is associated with Gamma Group — which goes by other names, including FinFisher and Lench IT Solutions.

BlackOasis in recent months sent a wave of phishing emails. These emails contained malicious Microsoft Word documents with the aforementioned Flash Player zero-day hidden inside an embedded ActiveX object. In the past, BlackOasis messages were designed to appear like news articles from 2016 about political relations between Angola and China.

The term zero-day is indicative of a software flaw that remains unknown to the software’s creator. Zero-days can be highly disruptive because they provide a window of time for an attacker to breach victims before the vendor is able to apply a software update to address the specific security hole.

U.S. cybersecurity firm FireEye also recently captured BlackOasis activity as part of a similar incident where the group relied on a different zero-day exploit — more specifically, a SOAP WSDL parser code injection vulnerability — to install FinSpy onto a small number of devices. Again, the attacker’s intention appeared to be espionage.

“Unlike other FinFisher customers or users who focus mostly on domestic operations, BlackOasis focuses on external operations and go after a wide range of targets around the world,” explained Costin Raiu, director of the global research and analysis team at Kaspersky Lab.

Gamma Group has been accused of selling its products to authoritarian regimes that can use the technology to both track dissidents and conduct foreign espionage over the internet.

The discovery by Kaspersky marks at least the fifth zero-day exploit used by BlackOasis and exposed by security researchers since June 2015. It’s unclear whether the hackers are purchasing the exploits and spyware together, directly from Gamma Group, or if they were able to acquire some of the tools through other avenues.

“BlackOasis’ interests span a wide gamut of figures involved in Middle Eastern politics and verticals disproportionately relevant to the region. This includes prominent figures in the United Nations, opposition bloggers and activists, and regional news correspondents,” a blogpost about Kaspersky’s findings reads.

The post continues, “during 2016, we observed a heavy interest in Angola, exemplified by lure documents indicating targets with suspected ties to oil, money laundering, and other illicit activities. There is also an interest in international activists and think tanks … Victims of BlackOasis have been observed in the following countries: Russia, Iraq, Afghanistan, Nigeria, Libya, Jordan, Tunisia, Saudi Arabia, Iran, Netherlands, Bahrain, United Kingdom and Angola.”

Brian Bartholomew, a senior security researcher with Kaspersky, said on Twitter that BlackOasis’ espionage included non-traditional targets — “going outside of that lawful surveillance boundary.”

An advanced persistent threat group, previously identified by Microsoft and codenamed Neodymium, is closely associated with BlackOasis’ operations.

Last year, Microsoft researchers described Neodymium’s behavior as unusual: “unlike many activity groups, which typically gather information for monetary gain or economic espionage, PROMETHIUM and NEODYMIUM appear to launch campaigns simply to gather information about certain individuals. These activity groups are also unusual in that they use the same zero-day exploit to launch attacks at around the same time in the same region. Their targets, however, appear to be individuals that do not share common affiliations.”

A cursory review of BlackOasis’ espionage campaign suggests there is some overlap between the group’s actions and Saudi Arabia’s geopolitical interests. For example, the targeting of Angolan organizations in mid-2016 coincidences directly with the rise of Angola’s oil business with China, which displaced Saudi Arabia as the number one exporter of crude oil to China at the time.

All 13 countries where Kaspersky reportedly observed BlackOasis activity are connected to Saudi Arabia in one of three ways: economically; from a national security perspective; or due to established policy agreements.

In addition, Saudi Arabia is a known customer of spyware and has used the technology domestically, according to Citizen Lab, a cybersecurity and human-rights focused research laboratory. Kaspersky’s research notes that BlackOasis hacked into computers based in Saudi Arabia.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure