Cybersecurity researchers have turned the spotlight on a new wave of offensive cyberattacks targeting Palestinian activists and entities starting around October 2021 using politically-themed phishing emails and decoy documents.
The intrusions are part of what Cisco Talos calls a longstanding espionage and information theft campaign undertaken by the Arid Viper hacking group using a Delphi-based implant called Micropsia dating all the way back to June 2017.
The threat actor's activities, also tracked under the monikers Desert Falcon and the APT-C-23, were first documented in February 2015 by Kasperksy and subsequently in 2017, when Qihoo 360 disclosed details of cross-platform backdoors developed by the group to strike Palestinian institutions.
The Russian cybersecurity company-branded Arid Viper the "first exclusively Arabic APT group."
Then in April 2021, Meta (formerly Facebook), which pointed out the group's affiliations to the cyber arm of Hamas, said it took steps to boot the adversary off its platform for distributing mobile malware against individuals associated with pro-Fatah groups, the Palestinian government organizations, military and security personnel, and student groups within Palestine.
Decoy document containing text on Palestinian reunification
The raft of new activity relies on the same tactics and document lures used by the group in 2017 and 2019, suggesting a "certain level of success" despite a lack of change in their tooling. More recent decoy files reference themes of Palestinian reunification and sustainable development in the territory that, when opened, lead to the installation of Micropsia on compromised machines.
The backdoor is designed to give the operators an unusual range of control over the infected devices, including the ability to harvest sensitive information and execute commands transmitted from a remote server, such as capturing screenshots, recording the current activity log, and downloading additional payloads.
"Arid Viper is a prime example of groups that aren't very advanced technologically, however, with specific motivations, are becoming more dangerous as they evolve over time and test their tools and procedures on their targets," researchers Asheer Malhotra and Vitor Ventura said.
"These [remote access trojans] can be used to establish long-term access into victim environments and additionally deploy more malware purposed for espionage and stealing information and credentials."
- Pentest Tools Find Subdomains
- Pentest Tools Kali Linux
- How To Install Pentest Tools In Ubuntu
- Hack Tools Pc
- Usb Pentest Tools
- Physical Pentest Tools
- Pentest Tools Find Subdomains
- Pentest Tools Subdomain
- Hacker Tools For Pc
- Pentest Tools Windows
- Usb Pentest Tools
- Hacking Tools Usb
- What Is Hacking Tools
- Hacking Tools
- Hacker Tools Linux
- Physical Pentest Tools
- Underground Hacker Sites
- Pentest Tools
- Hacker Tools Online
- Pentest Tools Url Fuzzer
- Pentest Reporting Tools
- Pentest Tools For Android
- Hacking Tools For Pc
- Underground Hacker Sites
- Hacker Search Tools
- Pentest Tools Url Fuzzer
- Tools 4 Hack
- Nsa Hack Tools
- Computer Hacker
- Pentest Tools Tcp Port Scanner
- Pentest Tools For Mac
- Blackhat Hacker Tools
- What Are Hacking Tools
- Hacker Tools Linux
- Tools Used For Hacking
- Hacking Tools Hardware
- Bluetooth Hacking Tools Kali
- Hack Tools Online
- Hack Tools For Games
- Hacker Search Tools
- Hacking Tools Usb
- Hackrf Tools
- Hacking Tools For Games
- Kik Hack Tools
- Pentest Tools Tcp Port Scanner
- Tools Used For Hacking
- Hacking Tools For Pc
- Hack And Tools
- Hacker Tools Hardware
- Hacker Tools Linux
- Hack Website Online Tool
- Pentest Recon Tools
- Hack Tools For Windows
- Easy Hack Tools
- Blackhat Hacker Tools
- Pentest Tools Bluekeep
- Hacking App
- How To Make Hacking Tools
- Android Hack Tools Github
- Hacker Tools
- Android Hack Tools Github
- Hacker
- Hacker Hardware Tools
- Hacking Tools For Games
- Pentest Automation Tools
- Hacker Tools For Mac
- Hack Tools For Ubuntu
- Pentest Tools Download
- Top Pentest Tools
- Hacking Tools Windows 10
- Hacking Tools Name
- Pentest Tools Bluekeep
- Pentest Tools List
- Pentest Tools For Windows
- Hacking Tools For Windows
- Hacker Tools Hardware
- Hacking Tools And Software
- New Hack Tools
- Hacker Tool Kit
- Hacking Apps
- Hacker Hardware Tools
- Pentest Tools For Mac
- Physical Pentest Tools
- Hacking Tools Kit
- Pentest Tools Windows
- Wifi Hacker Tools For Windows
- Hack Tools Mac
- Hack Tools For Windows
- Hacking Tools Github
- Hacker Tool Kit
- Pentest Tools Framework
- Pentest Tools For Android