Russian hackers spoof fake EFF domain to serve espionage malware

--ads--

Russian hackers believed to have links with Russian government clone EFF website and use it to deliver cyber espionage malware

Russian hackers previously linked to the hacking attack on White House and NATO had cloned a website belonging to EFF and served espionage malware. Security researchers found that the hackers having links to Russian government masqueraded as the Electronic Frontier Foundation in an attempt to infect targets with malware that collects passwords and other sensitive data.

The hackers believed to a part of Pawn Storm which had caused furore earlier this year, for hacking into White House and NATO servers, used a previously unknown zero-day Java exploit.

The attackers codenamed APT28 by FireEye, used URLs at the domain “electronicfrontierfoundation.org” in their phishing emails (the Electronic Frontier Foundation can be found at eff.org).

Operation Pawn Storm was unearthed by TrendMicro Labs targeted US military, embassy, and defense contractor personnel, dissidents of the Russian government, and international media organizations. Security firm FireEye has said the group behind the attacks has ties to Russia’s government and has been active since at least 2007.

Cooper Quintin from EFF made a blog post detailing how the hackers set up the fake EFF website using the url, electronicfrontierfoundation.org site. Quintin notes that the spoofed website had ability to infect all Windows, Mac and Linux machines. On Windows, the campaign downloads a payload known as Sednit that ultimately installs a keylogger and other malicious modules. Its use of the same path names, Java payloads, and Java exploits found in last month’s campaign mean it’s almost certainly the work of the same Pawn Storm actors that struck last month. Quintin wrote:

“The attack is relatively sophisticated—it uses a recently discovered Java exploit, the first known Java zero-day in two years. The attacker sends the target a spear phishing email containing a link to a unique URL on the malicious domain (in this case electronicfrontierfoundation.org). When visited, the URL will redirect the user to another unique URL in the form of http://electronicfrontierfoundation.org/url/{6_random_digits}/Go.class containing a Java applet which exploits a vulnerable version of Java. Once the URL is used and the Java payload is received, the URL is disabled and will no longer deliver malware (presumably to make life harder for malware analysts). The attacker, now able to run any code on the user’s machine due to the Java exploit, downloads a second payload, which is a binary program to be executed on the target’s computer.”

Quintin said he suspects electronicfrountierfoundatioin.org has been serving malware since August 4, when the domain address was registered. Surprisingly, as of Friday, the spoofed website was redirecting users to the authentic EFF page.

If you have visited electronicfrontierfoundation.org during past few days, it is better to get your PC/Laptop searched for espionage malware such as keyloggers and get it cleaned.

--ads--