Mobile spy program targets oil industry

A cyber-espionage campaign thought to be the next step in the Red October operation appears to be targeting, among others, oil industry users of Android, iOS and BlackBerry mobile devices through spear-phishing attacks.


A cyber-espionage campaign is targeting, among others, oil industry users of Android, iOS and BlackBerry mobile devices through spear-phishing attacks. The campaign uses a complex infrastructure relying on "a convoluted network of router proxies and rented hosts, most likely compromised because of poor configurations or default credentials," to deliver targeted malicious emails, said researchers at security and network solutions provider Blue Coat.

Because of this, they named the campaign "The inception framework," a reference to Christopher Nolan's 2010 movie Inception starring Leonardo DiCaprio.

Another security firm analyzed the malware used in this operation who called the malware Cloud Atlas and identified plenty of similarities to the toolset used in the Red October campaign, said researchers at Kaspersky Lab.

"The interests of Cloud Atlas attackers match those of Red October, taking into account the geopolitical changes from the last 2 years," said Costin Raiu, director of global research and analysis team (GReAT) at Kaspersky Lab.

In an extensive report on Inception/Cloud Atlas, Blue Coat revealed the bad guys planned attacks on mobile devices of high-profile targets in different sectors, from finance and oil industry to military, engineering and politics, in different parts of the world.

The researchers found the attackers were able to use the URL shortening service to create links pointing to machines serving malicious payloads for the mobile devices.

From one account alone, about 10,000 such links ended up created, all leading to only three IP addresses, with a pattern that included a target identifier and an action code for serving malware guised as an app update (WhatsApp or Viber) or MMS phishing. In the case of phishing, the action code also identified the mobile carrier for the device in order to deliver the appropriate telecom company logo.

Blue Coat said they were not able to get all the data on the targeted mobile operators because the attackers took the servers offline.

"We managed to get 66 of a total of 190," which accounts for 35%, after going through 3152 of 4781 phishing links, the report said. According to the intelligence they collected, it appears that the top three operators were Vodafone, T-Mobile, and Proximus (Belgacom).

After analyzing the malicious updates, Blue Coat found the main feature of the Android version of the malware was to record phone calls, but it could also track location, read contact list, monitor incoming/outgoing calls or text messages.

The attackers used LiveJournal accounts to store the information and communication with the compromised device.

On iOS, researchers found the fake update impersonated a Cydia installer, which could be add on to jail broken devices.

The data would end up exfiltrated to an FTP account on a hosting service in the UK, and included device and system information, address book, phone number, name of the carrier, Wi-Fi status, MAC address, battery level, total and free space, time zone (default and local), Apple ID, list of downloaded apps, and computer used for creating a backup.

On the BlackBerry platform, a similar set of details as in the case of iOS ended up retrieved and delivered to a DynDNS domain in a U.S.-based webhosting service.

Important to note is the command and control servers are different for each platform. In the case of desktop computers, the attackers relied on Swedish cloud storage service Cloud Me to store the stolen data and to deliver new modules to the compromised system.

Gregory Hale is the editor and founder of Industrial Safety and Security Source (, a news and information website covering safety and security issues in the manufacturing automation sector. This content originally appeared on ISSSource. Edited by Joy Chang, Digital Project Manager, CFE Media, 

No comments
The Engineers' Choice Awards highlight some of the best new control, instrumentation and automation products as chosen by...
The System Integrator Giants program lists the top 100 system integrators among companies listed in CFE Media's Global System Integrator Database.
The Engineering Leaders Under 40 program identifies and gives recognition to young engineers who...
This eGuide illustrates solutions, applications and benefits of machine vision systems.
Learn how to increase device reliability in harsh environments and decrease unplanned system downtime.
This eGuide contains a series of articles and videos that considers theoretical and practical; immediate needs and a look into the future.
Motor specification guidelines; Understanding multivariable control; Improving a safety instrumented system; 2017 Engineers' Choice Award Winners
Selecting the best controller from several viewpoints; System integrator advice for the IIoT; TSN and real-time Ethernet; Questions to ask when selecting a VFD; Action items for an aging PLC/DCS
Robot advances in connectivity, collaboration, and programming; Advanced process control; Industrial wireless developments; Multiplatform system integration
Motion control advances and solutions can help with machine control, automated control on assembly lines, integration of robotics and automation, and machine safety.
This article collection contains several articles on the Industrial Internet of Things (IIoT) and how it is transforming manufacturing.

Find and connect with the most suitable service provider for your unique application. Start searching the Global System Integrator Database Now!

Future of oil and gas projects; Reservoir models; The importance of SCADA to oil and gas
Big Data and bigger solutions; Tablet technologies; SCADA developments
SCADA at the junction, Managing risk through maintenance, Moving at the speed of data
Automation Engineer; Wood Group
System Integrator; Cross Integrated Systems Group
Jose S. Vasquez, Jr.
Fire & Life Safety Engineer; Technip USA Inc.
click me