Researchers at IBM X-Force are tracking a phishing campaign that’s using themes related to the Israel-Hamas war to deliver Headlace, a backdoor exclusively used by the suspected Russian state-sponsored threat actor ITG05. ITG05 has overlaps with groups tied to Russia’s GRU, including APT28 (also known as “Fancy Bear.”)
We recently covered initial reports of these types of attacks on the blog, and it looks like this trend is continuing with no end in sight.
Researchers at IBM explained in a statement, “The newly discovered campaign is directed against targets based in at least 13 nations worldwide and leverages authentic documents created by academic, finance, and diplomatic centers,” the researchers write. “ITG05’s infrastructure ensures only targets from a single specific country can receive the malware, indicating the highly targeted nature of the campaign.”
The researchers add, “The contents of each lure contain themes relevant to a unique audience interested in research and policy creation. The nature of the lures suggests activity is directed at entities with direct influence on the allocation of humanitarian aid, primarily those based in Europe. Our discovery includes multiple legitimate documents associated with finance, think tanks, educational organizations, and government and nongovernment organizations (NGOs) leveraged as lure materials. These files are featured in larger infection chains associated with the delivery of the ITG05 exclusive Headlace backdoor capable of facilitating multiple malicious actions on objectives.”
The goal of the campaign is unclear, but the researchers note that most of the targeted countries are members of the United Nations Human Rights Council.
“It is unclear precisely how many entities were impacted by the campaign, but our analysis indicates that organizations in the following countries were targeted: Hungary, Türkiye, Australia, Poland, Belgium, Ukraine, Germany, Azerbaijan, Saudi Arabia, Kazakhstan, Italy, Latvia and Romania,” X-Force explains.
“Of note, all but one of the 13 nations featured in the geolocations perimeters for downloading Headlace are United Nations Human Rights Council members. It is highly likely the compromise of any echelon of global foreign policy centers may aid officials’ interests with advanced insight into critical dynamics surrounding the International Community’s (IC) approach to competing priorities for security and humanitarian assistance.”
KnowBe4 enables your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
SecurityIntelligence has the story.
Here's how it works:
