Symantec warns of "heightened ambitions" of Iranian hackers targeting Middle East.
A digital security specialist has raised concerns of the "heightened ambitions" of a cyberattack group from Iran which is threatening to resurface and pose a real risk to transport networks in the Middle East. The Iranian hacking group, Chafer, last year targeted a range of organisations in the region with the motive of gathering intelligence, using infected Microsoft Excel documents to gain unlawful access to “airlines and aircraft services”. The illegal group also attacked telecoms and travel reservation companies.
Symantec, the California-based software company, published on its website that Chafer has traditionally focused its attention on the countries Jordan, Israel, The United Arab Emirates, Turkey and Saudi Arabia and became active since at least July 2014. Since then the hacking group has employed new strategies, introducing seven new tools that have led to it infiltrating nine new organisations in the Middle East.
Exposing the companies to malicious file hidden in an Excel document, which then installs three files on the computer and steals information from the compromised computer, Chafer reportedly accessed a telecoms company in the Middle East to facilitate surveillance of the company’s end-user customers and give the hackers a “vast pool” of new targets. It’s that approach that ultimately led Chafer to infiltrate an African airline, the details of which were harvested from the database of a travel reservations company.
Providing details on the seven new systems that Chafer is using, as well as malware the group is known to have already used, Symantec revealed that many of them are “freely available, off-the-shelf” tools that are then put to a malicious use.
non-sucking Service Manager (NSSM): An open-source alternative to the Windows Service Manager which can be used to install and remove services and will restart services if they crash.
NBTScan: A free tool for scanning IP networks for NetBIOS name information.
Read: £2.41tn of cyberattack risk, global hotspots and other threats revealed in alarming new report.
Read: “Train attacks are no longer science fiction,” declares startup after raising $4.7M to protect rail and metro from cyberattacks.