Mobile spy program targets oil industry

A cyber-espionage campaign thought to be the next step in the Red October operation appears to be targeting, among others, oil industry users of Android, iOS and BlackBerry mobile devices through spear-phishing attacks.

By Gregory Hale, ISSSource January 15, 2015

A cyber-espionage campaign is targeting, among others, oil industry users of Android, iOS and BlackBerry mobile devices through spear-phishing attacks. The campaign uses a complex infrastructure relying on "a convoluted network of router proxies and rented hosts, most likely compromised because of poor configurations or default credentials," to deliver targeted malicious emails, said researchers at security and network solutions provider Blue Coat.

Because of this, they named the campaign "The inception framework," a reference to Christopher Nolan’s 2010 movie Inception starring Leonardo DiCaprio.

Another security firm analyzed the malware used in this operation who called the malware Cloud Atlas and identified plenty of similarities to the toolset used in the Red October campaign, said researchers at Kaspersky Lab.

"The interests of Cloud Atlas attackers match those of Red October, taking into account the geopolitical changes from the last 2 years," said Costin Raiu, director of global research and analysis team (GReAT) at Kaspersky Lab.

In an extensive report on Inception/Cloud Atlas, Blue Coat revealed the bad guys planned attacks on mobile devices of high-profile targets in different sectors, from finance and oil industry to military, engineering and politics, in different parts of the world.

The researchers found the attackers were able to use the Bit.ly URL shortening service to create links pointing to machines serving malicious payloads for the mobile devices.

From one account alone, about 10,000 such links ended up created, all leading to only three IP addresses, with a pattern that included a target identifier and an action code for serving malware guised as an app update (WhatsApp or Viber) or MMS phishing. In the case of phishing, the action code also identified the mobile carrier for the device in order to deliver the appropriate telecom company logo.

Blue Coat said they were not able to get all the data on the targeted mobile operators because the attackers took the servers offline.

"We managed to get 66 of a total of 190," which accounts for 35%, after going through 3152 of 4781 phishing links, the report said. According to the intelligence they collected, it appears that the top three operators were Vodafone, T-Mobile, and Proximus (Belgacom).

After analyzing the malicious updates, Blue Coat found the main feature of the Android version of the malware was to record phone calls, but it could also track location, read contact list, monitor incoming/outgoing calls or text messages.

The attackers used LiveJournal accounts to store the information and communication with the compromised device.

On iOS, researchers found the fake update impersonated a Cydia installer, which could be add on to jail broken devices.

The data would end up exfiltrated to an FTP account on a hosting service in the UK, and included device and system information, address book, phone number, name of the carrier, Wi-Fi status, MAC address, battery level, total and free space, time zone (default and local), Apple ID, list of downloaded apps, and computer used for creating a backup.

On the BlackBerry platform, a similar set of details as in the case of iOS ended up retrieved and delivered to a DynDNS domain in a U.S.-based webhosting service.

Important to note is the command and control servers are different for each platform. In the case of desktop computers, the attackers relied on Swedish cloud storage service Cloud Me to store the stolen data and to deliver new modules to the compromised system.

Gregory Hale is the editor and founder of Industrial Safety and Security Source (ISSSource.com), a news and information website covering safety and security issues in the manufacturing automation sector. This content originally appeared on ISSSource. Edited by Joy Chang, Digital Project Manager, CFE Media, jchang@cfemedia.com 

Original content can be found at www.isssource.com.