A Middle Eastern advanced persistent threat (APT) group has resurfaced after a two-month hiatus to target government institutions in the Middle East and global government entities associated with geopolitics in the region in a rash of new campaigns observed earlier this month.
Sunnyvale-based enterprise security firm Proofpoint attributed the activity to a politically motivated threat actor it tracks as TA402, and known by other monikers such as Molerats and GazaHackerTeam.
The threat actor is believed to be active for a decade, with a history of striking organizations primarily located in Israel and Palestine, and spanning multiple verticals such as technology, telecommunications, finance, academia, military, media, and governments.
The latest wave of attacks commenced with spear-phishing emails written in Arabic and containing PDF attachments that come embedded with a malicious geofenced URL to selectively direct victims to a password-protected archive only if the source IP address belongs to the targeted countries in the Middle East.
Recipients who fall outside of the target group are diverted to a benign decoy website, typically Arabic language news websites like Al Akhbar (www.al-akhbar.com) and Al Jazeera (www.aljazeera.net).
"The password protection of the malicious archive and the geofenced delivery method are two easy anti-detection mechanisms threat actors can use to ..
Support the originator by clicking the read the rest link below.
