Russia Weaponizes Israel-Hamas Conflict in Targeted Phishing Attack
Researchers at IBM X-Force are tracking a phishing campaign that’s using themes related to the Israel-Hamas war to deliver Headlace, a backdoor exclusively used by the suspected Russian state-sponsored threat actor ITG05. ITG05 has overlaps with groups tied to Russia’s GRU, including APT28 (also known as “Fancy Bear.”)
We recently covered initial reports of these types of attacks on the blog, and it looks like this trend is continuing with no end in sight.
Researchers at IBM explained in a statement, “The newly discovered campaign is directed against targets based in at least 13 nations worldwide and leverages authentic documents created by academic, finance, and diplomatic centers,” the researchers write. “ITG05’s infrastructure ensures only targets from a single specific country can receive the malware, indicating the highly targeted nature of the campaign.”
The researchers add, “The contents of each lure contain themes relevant to a unique audience interested in research and policy creation. The nature of the lures suggests activity is directed at entities with direct influence on the allocation of humanitarian aid, primarily those based in Europe. Our discovery includes multiple legitimate documents associated with finance, think tanks, educational organizations, and government and nongovernment organizations (NGOs) leveraged as lure materials. These files are featured in larger infection chains associated with the delivery of the ITG05 exclusive Headlace backdoor capable of facilitating multiple malicious actions on objectives.”
The goal of the campaign is unclear, but the researchers note that most of the targeted countries are members of the United Nations Human Rights Council.
“It is unclear precisely how many entities were impacted by the campaign, but our analysis indicates that organizations in the following countries were targeted: Hungary, Türkiye, Australia, Poland, Belgium, Ukraine, Germany, Azerbaijan, Saudi Arabia, Kazakhstan, Italy, Latvia and Romania,” X-Force explains.
“Of note, all but one of the 13 nations featured in the geolocations perimeters for downloading Headlace are United Nations Human Rights Council members. It is highly likely the compromise of any echelon of global foreign policy centers may aid officials’ interests with advanced insight into critical dynamics surrounding the International Community’s (IC) approach to competing priorities for security and humanitarian assistance.”
KnowBe4 enables your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
SecurityIntelligence has the story.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW