Russian Hackers Caught Spoofing EFF Site to Serve Espionage Malware for 3+ Weeks
Security researchers have uncovered a spear-phishing campaign they believe is linked to the Russian government acting as the Electronic Frontier Foundation (EFF) in an attempt to infect targets with malware that can spy on the user and steal login information among other sensitive pieces of information.
Researchers identified emails crafted to specific targets, which link to the fraudulent domain electronicfrontierfoundation[dot]org, which appears to be apart of a larger campaign known as Pawn Storm. Just lat October, security firm Trend Micro brought light to the campaign targeting U.S. military, embassy, defense contractor personnel, dissidents of the Russian government as well as international media organizations. The security firm said the espionage malware campaign had entered a new phase when it began exploiting a zero-day vulnerability in Oracle’s widely used Java plugin. Another security firm, FireEye [PDF], said the group has had active ties to the Russian government and has been active since at least 2007.
Electronic Frontier Foundation staff technologist Cooper Quintin published a blog post on Thursday stating that attacks on the electronicfrontierfoundation[dot]org domain may have had the ability to infect Windows, Mac and Linux machines. On Windows, the malware downloads a payload that installs a keylogger among other malicious software. The software uses the same path names, Java payloads and Java exploits that were being exploited in last month’s malware campaign, pointing fingers at the same Pawn Storm actors that struck last month. In his post, Quintin wrote:
“The attack is relatively sophisticated—it uses a recently discovered Java exploit, the first known Java zero-day in two years. The attacker sends the target a spear phishing email containing a link to a unique URL on the malicious domain (in this case electronicfrontierfoundation.org). When visited, the URL will redirect the user to another unique URL in the form of http://electronicfrontierfoundation.org/url/{6_random_digits}/Go.class containing a Java applet which exploits a vulnerable version of Java. Once the URL is used and the Java payload is received, the URL is disabled and will no longer deliver malware (presumably to make life harder for malware analysts). The attacker, now able to run any code on the user’s machine due to the Java exploit, downloads a second payload, which is a binary program to be executed on the target’s computer.”
Quintin said he believes the electronicfrontierfoundation[dot]org domain has been serving malware since August 4, the day the domain address was registered. The site was reported as abuse, but was still actively exploiting the Java vulnerability on Thursday. However, on Friday morning, the domain was redirecting the the official EFF.org domain. At the time of writing this article, when the domain is opened in a browser it warns that the site has been used for attacks and to proceed with caution. However, it appears the domain is still redirecting to the official EFF.
The attack is another reminder of just how important it is to install security updates regularly. However, the fraudulent EFF domain has since been cleared up.
