Thread by @juanandres_gs

When researching MeteorExpress, I couldn't have guessed the direction the discussion would take. Let's take a minute to evaluate these different claims– Indra, non-state-sponsored, MBC, SEA... (thread)

(1)Let's dispense with the patently brittle claims– just because a ransomware group claims they perpetrated an attack doesn't make a credibly claim... looking at you DarkTracer.

(2)Subsequent claims that it's related to SEA are using a reference so outdated as to be meaningless. Additionally, SEA was a pro-regime group so nothing about this adds up other than a vague Syria connection.

(3) On a more interesting note, Checkpoint folks pointed out targets in Syria and a connection to a group that calls themselves Indra. Super interesting and built on solid ground– I found Comet, Comet is related to Stardust, Stardust makes reference to Indra in the code.

Indra, it turns out, not only has a social media presence (@: Indra17857623/ but also claimed the Syrian attacks (showing alleged exfil) before the account went dark in Nov 2020.
Now this is where we need to exercise some caution...

Having a social media presence claiming themselves hacktivists doesn't substantiate the idea that it's an independent, non-state-sponsored entity.We've seen plenty of examples where these masks have crumbled under scrutiny (Guardians of Peace, CyberBerkut, CyberCalliphate,YCA)...

While attacking the Iranian railway system was a loud showy attack, targeting in Syria of money transfer service allegedly helping launder funds and a private airline company transporting Iranian forces to exfil compromising evidence of these claims speaks to a different activity

With entities like Lab Dookhtegan spinning narratives based on leaks wrapped in 'freedom fighting' rhetoric, we need to be particularly discerning about the entities we are imbuing with legitimacy. There are larger forces at play here and they're counting on our amplification.

That should say ‘Meteor’ not comet 🤦🏻‍♂️