Hacker-for-hire group targeting South Asian organizations, research says

There’s a new cyber mercenary group on the block.

There’s a new cyber mercenary group on the block, and they’re going after targets in more than a dozen countries around the globe, according to BlackBerry research published Thursday.

The hack-for-hire shop, which BlackBerry is calling “CostaRicto,” has largely gone after targets in South Asia, especially in India, Bangladesh and Singapore, according to BlackBerry. Some of its targeting has also been located in Africa, the Americas, Australia and Europe, including in Austria, the Bahamas, France, Mozambique, the Netherlands and Portugal, the researchers write in a blog on the group.

It isn’t exactly clear who the hackers-for-hire are, but given that their targets tend to be focused in South Asia, BlackBerry researchers suggest they may be based in that region. The disparate targeting and characteristics of their toolset suggest they are working on behalf of clients, BlackBerry reachers write.

CostaRicto targets victims with a custom backdoor that appeared last October, but has rarely been seen in use in the wild. That could indicate it is held privately and used exclusively by this group, the researcher write.

The way their custom backdoor, dubbed SombRAT, is configured hints that it is intended to be updated and used over time, suggesting it can be adapted to different targeting needs.

“The constant development, detailed versioning system and well-structured code that allows for easy functionality expansion — all suggest that the toolset is part of a long-term project, rather than a one-off campaign,” the researchers write in the blog, adding that the diverse set of targets suggests assignments from clients rather than a singular, directed espionage campaign.

The hackers-for-hire also work to steal their targets’ credentials, either through spearphishing or by purchasing them on the dark web, according to BlackBerry.

The CostaRicto mercenary operation is part of a growing trend of hack-for-hire shops doing the bidding of malicious actors around the world documented by researchers. One such shop, known as Bahamut, has been using malicious applications, disinformation, and software flaws to surveil targets in the Middle East and South Asia, for instance, according to previous BlackBerry research. An Indian cybersecurity firm known as BellTroX has also been conducting cyber-operations for clients, according to Citizen Lab. Other India-based cybersecurity contractors have also been acting as mercenary hackers for years, according to the Electronic Frontier Foundation.

Well-resourced businesses and government-backed actors who want to mask their involvement in surveillance operations, as well as entities who lack hacking skills, all may have an interest in taking advantage of these kinds of hack-for-hire shops, BlackBerry researchers said.

“Outsourcing attacks or certain parts of the attack chain to unaffiliated mercenary groups has several advantages for the adversary — it saves their time and resources and simplifies the procedures, but most importantly it provides an additional layer of indirection, which helps to protect the real identity of the threat actor,” BlackBerry researchers write.

Like many of the other hacker-for-hire operations, this one appears to have been operational for at least many months, according to BlackBerry. While the earliest timestamps for the custom backdoor date to October of last year, the timestamps on the payload stagers, which date to 2017, could suggest a longer-running operation.

Security researchers have long been calling for the global community to do more to rein in hacking-for-hire operations around the world. Earlier this week the European Parliament announced it had reached an agreement that would place stricter controls on the export of spyware outside of the European Union, suggesting the norms on outsourcing surveillance operations could be on the cusp of changing.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure