Are Eastern European and Middle Eastern hacking groups looking to recreate a digital Ottoman Empire? Norse Intelligence Analysis Team has identified several indicators that reveal a trend involving groups located in the Middle East working closely with European hackers to share Tactics, Techniques, and Procedures (TTPs) for conducting politically and ideologically-motivated hacks. And this trend is not just your average script kiddy begging for N-day exploit proverbial scraps; rather, it’s an established pattern of direct and continuous contact between Middle Eastern hackers traveling to Europe to obtain training and experience, then either staying or returning home to begin politically-motivated attacks on global targets. The following cases provide some of the evidence collected by Norse analysts to support this theory*: CASE 1: ASHIYANE DIGITAL SECURITY TEAM (ADST) AND THE ROMANIAN SECURITY TEAM (RST) Members of the Ashiyane Digital Security Team (ADST), one of Iran’s most notorious hacking groups, and the Romanian Security Team (RST), the largest online hacker community based in Romania, have been exchanging exploit and target data. A series of posts on the RST forum announced a list of compromised Simple Message Text Protocol (SMTP) systems. Six months later, a large volume of the same compromised systems appeared in a post on the ADST forum from a hacker known to operate in France. Some of the compromised SMTP systems were identified by Norse as used in phishing campaigns as well as other malicious activity. Is this a coincidence, or evidence that supports behind-the-scenes sharing of information between typically unrelated hackers? CASE 2: MIDDLE EAST CYBER ARMY (MECA) MEMBER CAUGHT BY BULGARIA’S CHIEF DIRECTORATE FOR COMBATING ORGANIZED CRIME (CDCOC) A suspected member of the Middle East Cyber Army (MECA) alleged to have attacked more than 3,500 websites, including government and corporate websites, was brought down by the Bulgarian Chief Directorate for Combating Organized Crime (Cyber Division) on 15JUL2015. The authorities confiscated computer systems, laptops, and external media that contained a wealth of specialized hacking tools. The suspect is believed to be a 21 year old Syrian hacktivist that was studying in Bulgaria while also carrying out ideologically motivated cyber-attacks. The question remains as to who may have been training this person. CASE 3: GLOBAL ANONYMOUS MEMBERS ACTIVELY INVOLVED IN POLITICAL/RELIGIOUSLY-MOTIVATED HACKTIVISM Anonymous has created a hacktivist campaign for the release of Ali Mohammed al-Nimr called #OpNimr. Ali, is a 21-year-old boy sentenced to a beheading then crucifixion by the Saudi Arabian government for acts committed while he was a minor. Ali was arrested in 2012 when he was only 17 for taking part in a protest. According to the anti-death penalty organization reprieve, he was tortured and forced to sign a confession in 2012 and, after two years, he was sentenced to death on May 2014. Anonymous is comprised of a global membership, however a large contingent of active members comes from Europe as well as the Middle East. Based on current indications, we expect to see continuing increases in skill development and hacktivism from Middle Eastern hackers training in Europe. As their numbers, interests and skills grow, the dangers also increase the likelihood of a natural evolution from Website Defacement and Denial of Service (DoS) activities to truly worrisome Cyber-Terrorism activities capable of destroying infrastructure and putting real lives at risk. The ever-increasing technical capabilities empowered by Eastern European training combined with the political uncertainties in various parts of the region enables a clear and significant threat to local governments, their allies, and other entities that fall within their crosshairs. *Further detail withheld to protect sources. SOC Team
Norse Corporation, a ﻿well-respected cyber-espionage expert, report a growing trend of Middle Eastern groups providing high level training to﻿ Eastern European hacktivists Among the examples given is﻿ that of﻿ Romanian Security Team (the largest on-line hacker group in the country) training members of the Ashiyane Digital Security Team, Iran's most notorious hacking group. Norse suggests that as the trend grows "the dangers also increase the likelihood of a natural evolution from website defacement and Denial of Service (DoS) activities to truly worrisome cyber-terrorism activities".