Advanced persistent threat (APT) activity in the second quarter this year included a number of attacks targeting or originating in the Middle East and South Korea, a new report found.
While the goal for many of these threats was focused on cyberespionage or financial gain, one campaign trend varied from the rest with the purpose of spreading misinformation, according to a report by Kaspersky.
Kaspersky’s APT trends summary is compiled using information from resources including Kaspersky’s private threat intelligence research to highlight the main developments that researchers believe the public should be aware of.
In the second quarter, Kaspersky researchers observed interesting activity in the Middle East including a series of online asset leaks such as code, infrastructure, group and apparent victim details, allegedly belonging to known Persian-speaking threat actors, OilRig and MuddyWater. Though these leaks originated from different sources, they all appeared within a few weeks of each other. The third online leak, which was said to expose information related to an entity called the “RANA institute,” was published in Persian on a website called “Hidden Reality.”
Kaspersky researchers’ analysis of the materials, infrastructure and the dedicated website led to the conclusion that this particular leak could be connected to the threat actor, Hades. Hades is the well-known cyber threat group behind the OlympicDestroyer incident targeting the 2018 Winter Olympic Games, as well as the ExPetr worm and other various disinformation campaigns including the 2017 leak of emails relating to Emmanuel Macron’s presidential election campaign in France.
Additional APT highlights in Q2 2019 include:
• Russian-speaking groups continue to consistently refine and release new tools and launch new operations.
• Korean-related activity remained high while the rest of South East Asia saw less activity than in previous quarters.
• Researchers also observed an active campaign targeting government bodies in Central Asia by Chinese-speaking APT group SixLittleMonkeys using a new version of the Microcin Trojan and a RAT that Kaspersky calls HawkEye as a last stager.
“The second quarter of 2019 shows just how clouded and confusing the threat landscape has become, and how often something is not what it seems,” said Vicente Diaz, principal security researcher, Global Research and Analysis Team, Kaspersky. “We saw a threat actor hijacking the infrastructure of a smaller group and another group possibly capitalizing on a series of online leaks to spread disinformation and undermine the credibility of exposed assets. The security industry faces an ever-growing task to cut through the smoke and mirrors to find the facts and threat intelligence that cybersecurity relies on. As always, it is important to add that our visibility is not complete, and there will be activity that is not yet on our radar or not fully understood, so protection against both known and unknown threats remains vital for everyone.”
Click here for the full report.