New: The hackers behind a watering-hole campaign against targets in the Middle East may be using software from the Israeli spyware firm Candiru, recently targeted by U.S. export restrictions, according to @ESET: subscriber.politicopro.com/article/2021/1…
In research being presented today at @CYBERWARCON, ESET experts say an IP address linked to Candiru in a recent @citizenlab report has ties to two of the malicious domain names in the watering-hole attacks.
These watering-hole attacks spoofed websites of Yemen’s parliament & interior ministry, Iran’s foreign ministry, Syria’s electricity ministry, @MiddleEastEye, and Hezbollah-linked TV channels.
Fake sites delivered malware that exploited web browser vulnerabilities.
Fake sites delivered malware that exploited web browser vulnerabilities.
@MiddleEastEye But the hackers got smarter between their 2020 and 2021 watering-hole campaigns, according to ESET.
They configured their malicious code to scan victims' computers and look for specific targets before deploying.
This prevented researchers from acquiring the malware to analyze.
They configured their malicious code to scan victims' computers and look for specific targets before deploying.
This prevented researchers from acquiring the malware to analyze.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
