Gaza based Hackers Targeting Israelis with ‘xxx Star Video’ Malware

Israel-Palestine conflict : New feature of the conflict rides to success on malware attached NSFW videos

The world most tumultuous conflict which has been raging since 1948 has already entered the cyber world but now there is another feature added to that cyber conflict. Gaza based hackers are targeting Israeli cyber users with NSFW video baits which contain malware and they have apparently been quite successful as per Trend Micro Labs. 

Trend Micro has discovered this new wave of cyber attacks being carried out against the Israeli government, military network and research infrastructure which has taken the aid of NSFW videos. Trend Micros states that there are two separate but similar cyber attacks and both seemed to be interlinked as the trail leads back to Gaza based hackers.

The attack

Israel’s National Cyber Authority spokesperson states that the Israeli government hasn’t received any indications of “substantial” damage from these attacks however, these attacks seem to be targeting Israeli citizens. Three individuals have been identified as part of the attack and all three are working in Tech firms in Gaza. 

These individuals are also either listed as the buyers of the German domains (from where the attacks originated) or are involved in subsequent attacks launched against Egyptian targets from Gaza. 

Trend Micro describes how the attack works,

Picture the following reconstruction based on one attack: An employee in an Israeli government research facility receives and opens a highly targeted phishing email. A NSFW movie starts to play on his screen, which he hurriedly closes before any of his colleagues notice. He then thinks nothing more of the event. Minutes later, an attacker from somewhere in the Gaza Strip in Palestine gets notified that a new victim’s system has been successfully infected. The attacker then proceeds to exfiltrate a package containing all of the interesting documents from the newly infected system.

Two of a kind 

The first one has been named Operation Arid Viper and involves spreading of malware via spam emails. This malware gathers data from compromised machines through what is known as a “smash-and-grab attack.” This attack is being carried out against high-level targets and makes use of NSFW content. The second campaign has been nicknamed Operation Advtravel. It is a low-level targeted attack affecting only a few hundreds in Egypt. 

It mainly infects personal laptops. Traces of its attackers have been found in Egypt. 

The similarities in the attacks is that they both are being hosted from a server based in Germany. Israel has blocked all digital communication from Gaza to avoid such attacks, but Germany isn’t blocked by Israel. Plus, the server is also registered under the same people who are detailed above. 

In comparison to the conventional APT-style attacks, Arid Viper appears much effective and serious whereas Advtravel seems to be slightly amateurish.

Dirty road to success

Israel is not unknown to such attacks, which is why the IP block is in place, yet, these attackers have managed to carry out the attack. The main reason is that the attacks are emanating from German servers, which are not blocked by Israel. Moreover, the use of NSFW content in the emails adds that much more honey to the click bait. 

The minute someone opens a NSFW content, his natural reaction will be to close the link and he will not think about it anymore. The employee won’t even report it if the email contains NSFW content for fear of shame. Both ways, this acts as a perfect foil for the Gazan hackers to complete their objective of exfiltrating data from Israeli cyber users.