89: Cybereason - Molerats in the Cloud

JACK: Hey there, did I surprise you?
I release episodes of this show every other week.
That’s two episodes a month, right?
So, why do we have an episode here, in the off-week?
Well, there’s this company called Cybereason who are big fans of this show and they wanted
to bring you an extra episode.
So, a deal was made which means this entire episode is brought to you by Cybereason.
I’ve never done anything like this before and so I want to be clear; this episode is
only here because Cybereason sponsored it.
But I’m excited because it’s a fantastic story that links back to one of my most popular
episodes.
You’re gonna hear from their CEO who has quite the back story and later in the episode,
we’re gonna hear a story from their threat research team who investigates and uncovers
malicious activity, and they’ll tell us about a time when they found a threat actor
lurking in someone’s e-mails.
They spent months tracking that threat actor which they called Molerats in the Cloud.
(INTRO): [INTRO MUSIC] These are true stories from the dark side of the internet.
I’m Jack Rhysider.
This is Darknet Diaries.
[INTRO MUSIC ENDS]
JACK: Okay, so let’s get started.
Can you just tell us your name and who are you?
LIOR: Hi, I’m Lior Div, the CEO and co-founder of Cybereason.
JACK: Yeah, I got the CEO of Cybereason on for this.
I’m not messing around here; going right to the top.
But the reason why I wanted to talk with Lior is not so much to hear about his company,
but I’m fascinated with what he did before that.
LIOR: Basically, my story starts at the age of sixteen.
For years I really wanted to be a combat pilot.
JACK: Here’s the thing; Lior grew up in Israel and it’s mandatory for everyone in
Israel to serve in the military.
So, he knew he was going in and was hoping he would be picked to fly jets.
LIOR: So basically, there is a very rigorous kind of list of tests that you need to go
through.
So, at the beginning, we were I think probably a thousand people that – doing the first
test.
I did not – knew back then kind of the test is for which unit or for what occupation specifically.
After that, they cut it by half and it was five hundred people, then from the five hundred
they cut it again to a hundred people.
From the hundred people, they choose twenty people and out of the twenty, they choose
four.
JACK: He did not get assigned to become a combat pilot, though.
Lior was assigned to work in Unit 8200.
LIOR: At the beginning, I was very disappointed because I had a very clear vision of what
I want to do.
Hindsight 20/20, I’m super happy that I was chosen to go to the 8200 Unit and not
to do other things.
I think that in a sense, they knew better than I am – what I am better at and direct
me to this direction.
I think that after all the tests that they did, they know you very well.
I’m joking sometimes when I’m saying probably they know you better than you know yourself.
JACK: So, no matter what you’re assigned to do in the Israeli military, you must first
do basic training.
You have to wear the military gear, do your push-ups and running, and learn how to use
a weapon and that sort of thing.
But once all that’s done, he reported for duty with Unit 8200 which is sort of like
Israeli’s version of the NSA.
LIOR: Back then, I did not – knew that – were talking about the 8200 Unit.
It was super classified.
This is before the days that you could read all about this unit on Wikipedia.
[MUSIC] I think that only a month after I joined the army, I realized that we’re talking
about this unit and kind of starting to understand what the unit is all about.
This unit is basically focusing on the field of signal intelligence.
JACK: So, he joined Unit 8200 back in the late 90s.
Yeah, it was a very secret organization back then.
Not only did the world not know about it but even people who worked in 8200 could not even
tell their family what unit they were working in.
As a kid, Lior was fascinated with wireless technology and especially how cell phones
worked.
LIOR: For me, it was fascinating because it’s like, all those things that I was fascinated
as a kid to really understand how things – works and try to manipulate them.
Suddenly there is a full unit that’s focusing on this field, very smart people and very
creative.
But the story is not ending there; it’s just starting there.
The unit have a very unique way to take people right out of high school and basically teach
them all the things that they need to do in order to be an expert in something.
At the beginning you are not an expert but you gain your knowledge, so in my case it
basically was six months of very, very rigorous training, that every week we were learning
something different.
In the end of this week, you need to have a test.
If you pass the test, you can go home.
If not, you stay and you need to pass the test.
There is no option not to pass it.
You’re ending up to have a very, very large understanding and knowledge when it’s come
to technology, everything from how a cellular network works, how the internet works.
You know, how a computer works and what do you need to know in order to write a Python
script, write code, and so on so forth.
JACK: He can’t go into specifics about what he did there but what’s public knowledge
about Unit 8200 is that they’re the signals intelligence branch of the Israeli military.
So, they’re code-makers and code-breakers.
In the modern era, they’re using computers and technology to collect intelligence which
sometimes means hacking into the adversary.
Lior was part of an advanced persistent threat, or nation state actor.
From the inside he was learning a lot about how cyber-attacks work.
He spent six years in Unit 8200.
The requirement is only to stay a year or two but Lior was really into it, so he stayed
longer.
He was promoted to officer and even captain before leaving.
LIOR: The 8200, that was kind of the beginning of my career.
After six years in the army, I went to the university.
Over there, it’s kind of in the reverse; over there, you are getting your knowledge
or the theoretical knowledge that you need but probably you already know the majority
of it because of your hands-on experience.
JACK: From there he got a job at a tech startup which got bought out by a larger company.
LIOR: Then, basically I established my own company.
This company eventually was a company that focused in the field of hacking, cracking,
reverse-engineering, you name it.
Eventually, this company was providing services to different government agencies.
JACK: This company would provide services for intelligence agencies in Israel.
So, Lior got to work with some pretty secret and classified missions there, learning advanced
ways to hack, crack, reverse-engineer, and more, and providing these services to intelligence
agencies.
LIOR: So, the work that we used to do is – sometimes I’m joking about it – is take things that
by definition that they are impossible and make them possible.
Usually what’s happening – you have a mission that you need to get information or
you need to manipulate information or you need to gain access to a specific type of
knowledge and in order to get it, first you have to understand where this knowledge is
– exist.
But then once you understand that thing, you have to plan and execute an operation basically
soup to nuts.
[MUSIC] For example, you will have a team that focus in deception, meaning that if it
wants to go into an asset and collect information – but you know that they are gonna protect
themselves very good.
JACK: Okay, I find this interesting; when hackers use deception as part of their methods.
Lior’s team had a mission to get into someone’s computer but if he just launches an attack
from his office, that can easily be traced back to him so he doesn’t want to do that.
The target can’t know who he is, so he has to be tricky.
One way to be deceptive is to get his team to distract the target.
LIOR: Let’s say that they are doing a massive DDoS attack on them; they will think that
this is what’s happening but on the back end of this DDoS attack, actually there is
the real hacking going on and somebody has managed to install let’s say a piece of
software on one of their machines and have the initial access.
JACK: Ah, that’s an interesting way to do it.
When you’re breaking into an adversary’s computer, you want to be as quiet and sneaky
as possible, right?
Well, Lior here decided to do the opposite.
He wanted to ring alarms but he wanted to ring so many alarms that when he did break
into the computer, he would just be able to hide in the noise which is one way to get
in undetected.
LIOR: But usually, most of the stories are stopping when we’re talking about the initial
access but in reality the penetration, the first act of going in and have a foothold
in an environment, this is just the beginning of an operation.
That’s not the end.
Usually from that point there is a very lengthy process that you have to do in order to first
understand where did you land, what asset do you have, and then to – the ability to
move from one machine to another machine in order to keep – map the environment.
The most important piece is to really locate the data that you need and start to collect
it.
Even once you find the data and you manage to collect it, the operation is not ended
because then you have to exfiltrate the data outside of organization and that’s, by itself,
can be a separate operation to do because just to get the data, this is one thing but
the ability to take it out, it’s another thing.
But this is another false notion that people think that the operation is starting and ending
and then hackers goes out and that’s it, but in reality when you talk about government
against government, once you manage to go in, you want to stay in.
You don’t want to go out and you want to have the ability to keep collecting information
and you want the ability to keep doing it.
Even if somebody finds you and you need to clear the environment and go out, you want
to make sure that you have backdoors to go in every time again and again.
JACK: According to Lior’s bio, it says he’s an expert in hacking operations, forensics,
reverse-engineering, malware analysis, cryptography, and evasion.
Yeah, evasion; that’s the practice of not being caught or stopped, like evading antivirus
detections and hiding your tracks and being unseen in the network.
But yeah, looking back at the experience he got from being in Unit 8200 and then formal
studies of computer science at a university and then working with intelligence agencies
to conduct secret missions, yeah, I’d say Lior is an expert hacker.
LIOR: As part of my time in those different units, I received a medal of honor for one
of – it was a very strategic operation that we needed to plan and execute.
Needless to say that we cannot go through the details of it.
Maybe one day we will be but for me, it was fascinating to understand that with enough
creativity and ingenuity, you can manipulate almost any network that exists out there and
almost bend physics to your benefits.
For me, to be part of this type of capabilities, it’s kind of proving to yourself.
But it’s not just about me; it’s about the team, that we were working together, that
if you really want to achieve something and you have the time and resources and creativity,
you can almost bend physics to your benefit.
I think that in that situation, we managed to do that.
I was super proud of the team and the execution of the mission back then.
JACK: What’s interesting is Lior was helping the Israeli intelligence units when Stuxnet
was going on.
If you’re not familiar with Stuxnet, check out Episode 29.
But this was an attack on an Iranian nuclear enrichment facility in order to thwart their
enrichment process.
This virus literally made its way into the centrifuges to degrade them which is just
phenomenal because nothing in the enrichment facility was connected to the internet, so
how could hackers get all the way into the centrifuges and then have this malware run
all by itself without any remote control?
That’s just incredible.
Now, of course Stuxnet is classified super tight, but the circumstantial evidence shows
that the US and Israel were behind this attack.
So, I just wonder if Lior had anything to do with that.
But of course, I can’t ask him.
But he does think that Stuxnet changed the world.
LIOR: I think that Stuxnet was the first time that people got a real demonstration of how
you can leverage software and code in order to achieve military or government goals.
That was the first time that people managed to see in the large scale the ability to leverage
in order to create a link between the cyber world into the physical world and actually
to achieve results in the physical world while you’re leveraging software.
‘Til that point, it was no real big demonstration of this capability.
It was a lot of theoretical one.
If we’re talking about an isolated network, air gapped and it has no connection to the
internet, then it’s become almost like magic.
The fascinating thing was that this virus or worm was not manually operated, meaning
it was dormant and once it’s understood that it’s on the target machine, it started
to run automatically and do whatever it’s – need to do.
Zero communication to the outside world.
The combination of all those things together kind of created – I believe sparked the
imagination of people and for me and my two co-founder, we just knew that from that moment
people will understand that there is a different type of problem out there, that we’re not
talking about IT security anymore, that when there is attackers that – kind of really
determined to go after a target, they will be able to do that.
We knew from our personal background that this is the reality and it’s not a mystery.
So, for us, we decided that this is time to basically do something because we knew to
– that – kill that moment, the adversary has an advantage and we said to ourselves
we have to reverse the adversary advantage.
We have to give back the power to the defenders in order to do something.
In order to do that, we said look, we’re gonna take the massive amount of years that
we have and really understand how hackers – works, like really, by viewing it from
the first-row seat and take all the knowledge that we have and – to be able to create
something new, a new mindset.
JACK: What he determined is defenders don’t have enough indicators to detect attacks.
I mean, if Lior was able to bypass antivirus, evade intrusion detection tools and then plant
himself in a system for a long period of time without being detected, then yeah, he knows
defenders are unable to detect him and what’s more, he knows exactly where to look to be
detected.
While traditionally defending teams look for indicators of compromise which could be a
known bad IP address or malicious packets or malware present, Lior and his team started
looking for malicious indicators of behavior which are signs that a malicious actor is
conducting their operation.
LIOR: Basically, we invented the new method and the method is operation-centric.
We call it the Malop, the malicious operation approach.
The Malop approach; basically assume that the hackers has many steps to do in an environment.
This is not just the act of penetrating into the environment, and we are gonna meet the
hackers whenever they are.
So, every step that they are gonna do, we are gonna anticipate the step and we’re
gonna be there and collect the information before they are doing anything.
In a sense, think about it that you just put the camera in every room, every door, and
you record everything.
You know that if you’re starting to see a behavior that is bad, you can say hey, right
now there is a malicious operation going on here.
So, it’s not about the malware; it’s about the Malop that you want to find.
It’s not about the gun; it’s about the people that’s using the gun.
JACK: I like this.
This sounds like user behavior analytics to me, and this is where you watch to see what
users typically do and then alert when they do something that’s out of their typical
activity.
Like, if Charles from accounting typically accesses the same six systems every day to
do his work and then suddenly starts trying to connect to some other peoples’ computers
that he’s never connected to before ever, this behavior is abnormal and worth looking
into.
LIOR: [MUSIC] Basically what you need – you need the ability to collect massive amount
of data in real time and then analyze the data as that data is coming through the system
and to make quick decision that can rely on a lot of data that we collected from the past.
But this technology was not exist, so basically between 2012 to May 2015, we invested heavily
of building a new technology.
This is a in-memory graph processing technology, that this is kind of the secrets behind Cybereason.
Many people think that we are just an endpoint company but in reality, if you look behind
the curtain, we are a big data analytic company that can really analyze massive amount of
data in real time and to find malicious operation in organization and not just the malware.
JACK: So, Cybereason was born.
Lior and his co-founders developed this method for collection and analysis.
In order for this to work effectively, he needs to install a little tool on every computer
in a company to collect data and send it to Cybereason.
This is called endpoint detection.
Actually, I think they call it endpoint protection because the tool doesn’t just detect but
also stops attacks.
They got this thing up and running.
Cybereason was officially ready and they started telling people about their solution.
LIOR: It was a big cellular network that approached us and said look, we think that we are under
attack. We’re not sure.
We see artifact.
We have every technology that exist out there but we cannot point a finger of what’s really
going on.
JACK: Okay, their first customer.
They were seeing some weird activity and they think a hacker was in the network but they
couldn’t find him.
So, it was go-time for Cybereason.
This was the first real test.
Time to get in the network, install this software on every computer in the whole company, and
see if this method of detection actually works.
But this was a big company.
LIOR: It took us a few days to deploy 50,000 sensor on every basically machine that they
have on-premise, in the Cloud, everything that they owned.
The system’s starting to run and for us, that was kind of the first demonstration to
see it’s live.
JACK: They got everything installed and were collecting tons of data from this company
and analyzing it.
But all was quiet.
LIOR: The first days after we installed the system, we did not – saw anything.
We asked them; it’s like, did you guys install it on every machine that you have?
It took them a while to admit that they did not install it everywhere.
JACK: [MUSIC] Ah, right; I get a kick out of this because some companies only focus
their security on certain systems in the network.
This reminds me of a personal story.
For a while, I was a security engineer and I was collecting logs and analyzing them for
malicious activity.
I found this one system was showing signs of infection and I reported it to the IT team.
You know what they said?
That’s impossible, because that IP doesn’t exist on our network.
So, I traced the packets all the way back to where the system was and I showed them
where it was, and they still didn’t believe me.
They didn’t take any action on fixing this infected system because they were sure there
was no such computer in their network with that IP.
But after a few weeks of insisting that it does exist, they finally took a look and found
it.
It was a computer that was not authorized to be plugged into the network and it wasn’t
using the IP scheme the company uses, and that’s a big problem that some companies
face; they have no idea what computers are even in their network.
Anyway, Lior was able to convince this company they needed to install the endpoint software
on all the computers.
LIOR: Once they decided to deploy it everywhere, immediately we’re starting to see those
artifacts of hacking operation or malicious operation going on.
For us, it was massive excitement because that was the first time that we saw a large-scale
attack on a massive network.
Think about it; there’s 50,000 endpoints connected.
It’s a cellular network so it’s very big.
We were ecstatic because we knew that this is not just the proof that the system works;
this is the proof that the method of finding malicious operation is better than just to
try to find this tool or that tool, because they saw the tools that the hackers used but
they could not tailor it to a story in order to be able to say hey, this is the story of
what’s going on right now.
In a sense, the malicious operation for us is the ability to tell a story of what hackers
are doing inside your environment.
The most important thing is to prevent them of doing it.
JACK: Were you on that call when you called to tell them okay, we found a hacker in your
network?
LIOR: Yeah, it’s…
JACK: Well, how did that go?
LIOR: The call with them, it was a very interesting call because we basically told them look,
we know that there is adversarial activity right now.
By then, we managed to prove that this is a group from China doing it.
It’s reached to the point that we knew who is the person that write the code.
The people that wrote the code, they made a major mistake and in one of the files that
they compiled, that – they leave the debugs, basically comments, and we managed to reverse-engineer
and see all their comments.
That enabled us to tie it back to a company in China that later on, it’s enabled us
to tie it back to a specific individual that was the owner of it, and then we managed to
prove that it was the Chinese government behind this attack.
[MUSIC] For us, it was fascinating.
On the call, we kind of came with the full presentation of hey, this is the group that’s
attacking you.
This is what they are doing.
This is how they are doing it.
They kind of at the beginning did not really – believed us.
I think that the turning point in the conversation was when Yonatan, my co-founder, said to them
look, we know that they stole the key to the castle.
Basically, they have the password, the admin password for every system that you have.
They started to laugh and they said look, we replaced the admin password two days ago.
It can’t be.
Basically, he gave them the password and then I think that it was almost three minutes of
quiet in the call and then they realized that it’s not just we managed to find this group
of hackers; we really managed to identify every step of the thing that they did all
the way to understand which password they are using, and this is kind of the hackers
use, and they, in that point of time, they just understood that they were owned.
JACK: This was a success.
Their first customer.
Not only did they find this adversary but they were also able to figure out who, why,
and what data was touched in the network.
Cybereason had spent three years getting to this point and now they knew their product
worked, and started building all kinds of extra tools and services on top of that.
Like, not only do they have a tool to detect what malicious activity is happening in the
network but they also have a full response team to go in and fix those issues, too.
Then on top of that, they have a threat intelligence team to do research on emerging threats.
LIOR: We are not just – know what’s going on out there, meaning what’s going on with
each and every one of the attacker.
What we are trying to do in a very aggressive way is to find how they are hacking, to find
their tactics and techniques and to expose them to the world.
Because once you do something like this, you basically throw the attackers back sometimes
half a year, sometimes a year.
Depends what you manage to find.
So, don’t be surprised that it’s like, every once in a while Cybereason is releasing
major research that basically kill the ability of this group to operate now for another year.
We’re a big believer it does make our customers’ base safer but it’s – make the world a
safer world.
This is kind of part of the mission of Cybereason, is to reverse the adversary advantage.
JACK: We’ll take a quick break here but stay with us because after the break, we’ll
hear a story from their threat research team and how they discovered a new piece of malware
that’s really interesting.
Now, it’s always fascinating to me when a security company exposes a certain threat
actor in the world because it’s always a good story.
There’s some shady activity group going on and a security company finds it, researches
it, figures out what happens, and then lets the world know about it.
Cybereason has so many of these stories where they faced off against adversaries.
So, I asked Assaf to come on to tell us one of these stories.
ASSAF: My name is Assaf Dahan.
I am heading the Nocturnus Threat Research Team at Cybereason.
JACK: [MUSIC] There’s this team inside Cybereason which is called Nocturnus.
The Nocturnus team are security researchers who hunt through the massive data they’ve
collected to try to find new threats nobody’s ever seen before.
So, for instance, suppose some computer is demonstrating indicators of malicious behavior
but an antivirus scan can’t find any vulnerabilities, so they narrow down what app or process of
that system is doing bad stuff, and that might lead them to discover an unknown piece of
malware, malware that was just created by an adversary recently that has never been
seen before in the security community.
This is what the Nocturnus team lives for.
Now, they’ll reverse-engineer that and dissect every part of the malware to try to figure
out everything about it; who made it?
Where did it come from?
What does it do?
So, this is where Assaf enters the scene and begins to investigate.
Just – I’m curious; how many languages do you speak?
ASSAF: Okay, I speak ten languages.
Not all at – on the same level or the same level of fluency but yeah, I speak ten languages.
JACK: Ten – and how does that fit into doing threat research?
ASSAF: Actually, it fits in quite well.
I think one of the most important things to keep in mind when working in the field of
threat intelligence or threat research is that beyond the technical aspect of how a
certain malware works or uncovering an infrastructure, you have to tie it to a global context or
a geopolitical context for instance, in that matter, or other research papers that we publish.
So, the ability to have firsthand, almost unmediated linguistic capabilities is quite
helpful.
In our team, we – I think if we combine all the languages, we speak like fifteen languages.
I’m accounting for ten of those, but – so, it helps, yeah.
It really helps, especially if you go on the darknet, there are different hacking forums,
there is some slang that is unique for hackers, or just reading documents whether it’s phishing
lure content and others, so it really gives you some understanding or better grasp of
what is actually going on beyond the technical aspects of how the bits and bytes of how a
certain malware works.
JACK: Assaf has been with Cybereason for five years now and back in early 2020 is when he
saw something interesting, a loose thread worth tugging at.
ASSAF: [MUSIC] Back then, we started noticing some interesting-looking phishing lures that
were quite politically-charged, targeted Middle Eastern entities.
Let’s call it that way, and they were very much focused on targeting Arabic speakers.
JACK: The phishing e-mails were written in Arabic and they were from a group called The
Popular Front of the Liberation of Palestine, which I don’t understand Middle Eastern
cultural politics all that much, but from Wikipedia it looks like this is a group that’s
fighting to retake Palestine back.
So, this group sent out phishing e-mails with malicious software attached.
Or did they?
Upon closer analysis, it looks like the e-mails didn’t actually come from that group but
it was made to look like it was coming from them in order to get their targets to read
the e-mails and open the attachment.
ASSAF: We believe – it’s our assessment that they targeted political figures within
the Palestinian authority that associated with Fatah, with the Fatah movement, as well
as other political entities in the Middle East.
So, that was back in February 2020 and that’s where we – when we discovered the Spark
backdoor.
JACK: Hold on, I’m reading more on Wikipedia here and I’m finding this fascinating.
Palestine is a sovereign state that controls the Gaza Strip and West Bank which both border
Israel.
Yes, there are many land disputes between Israel and Palestine but there’s also internal
disputes just within Palestine itself.
I mean, look at what happened in 2007 at the Battle of Gaza.
At the time, the Gaza Strip was controlled by Fatah, but Hamas, another faction within
Palestine, waged a military-style attack against Palestine itself in an attempt to take over
the state.
So, you had Fatah and Hamas fighting to the death over who would be in control of the
Gaza Strip.
It was bloody and Hamas took over.
You see, the geopolitical aspect of all this is complicated.
But Assaf grew up in Israel with multicultural parents and speaks ten languages, so he understands
this pretty well.
Again, he said…
ASSAF: They targeted political figures within the Palestinian authority that associated
with the Fatah movement as well as other political entities in the Middle East.
JACK: The e-mails say things like…
ASSAF: For instance, it shows details; ‘Crown prince held secret meeting with Israeli prime
minister’, or ‘Details of the crown prince meeting with the US secretary of state’.
JACK: So, just from looking at the contents of these e-mails alone, we can already see
that having a strong geopolitical understanding has a role in doing this threat research.
[MUSIC] But anyway, they examine these e-mails and the e-mails have an attachment which is
an executable file, but the filename ends in .doc.exe and it has an icon which looks
like a regular Microsoft Word document.
But when you double-click on that, it actually installs the backdoor or malware, and then
it actually opens a Word doc, a decoy document, as they say.
This wasn’t really using any advanced vulnerability to get the malware installed on the system
but the Cybereason endpoint monitoring tools spotted this backdoor which they called Spark.
ASSAF: It’s a malware.
It’s a fully-fledged application that runs on the victim’s endpoints, usually – could
be laptops or a desktop and it gives the attacker pretty much full access to the computer or
the endpoint.
They can run different commands, they can use it to steal information, to control in
a – if they choose to, they can also control the machine, they can download additional
payloads, secondary payloads, which we see often, and basically harvest any information.
This is – it’s actually more of a – when you think about it, it’s more of a spyware,
actually.
It’s a tool that enables the attackers to carry out espionage attacks on their target.
JACK: When they discover malware like this, they first check to see if this has been documented
before.
One popular malware repository is virustotal.com.
You could send it there and they’ll tell you if they’ve ever seen it before.
But that doesn’t work very well for Arabic-written malware, so they checked other sources and
they determined they were dealing with a brand-new piece of malware.
ASSAF: That happened in February 2020.
Around let’s say October, November 2020, we started noticing new activity.
[MUSIC] We’ve been monitoring them since the discovery of Spark.
They’ve had different campaigns going on at the same time but around October, November,
we also noticed new tools that were never used or seen before being used in this specific
campaign.
What drew our attention was actually the geopolitical context.
We started seeing different phishing lure documents pertaining to the Israeli peace
process normalization between these – well, Israel and the Saudis, the Emirates, and other
content that is more related to internal Palestinian domestic affairs.
JACK: When doing threat research, you sometimes pull on a string and a whole fishing net comes
up with it.
The Cybereason Nocturnus team was uncovering a whole bunch of this threat actor’s infrastructure.
It wasn’t just phishing e-mails and the Spark malware, but now they’re seeing different
kinds of malware and more e-mail addresses of interest and watching how the hackers were
communicating with this malware, and so many more things to look into.
ASSAF: Basically, we started following a trail of evidence.
[MUSIC] So, we know that the operators sent a phishing PDF to their victims.
That PDF contained a simple link to either a Dropbox or a Google Drive archive file that
was stored on either of those platforms.
That archive file, whether it’s a zip or arj, it doesn’t matter, contained the backdoors.
One backdoor was Spark.
The other backdoor was SharpStage which I’m gonna talk about later, and the third one
was DropBook.
JACK: Okay, interesting.
Whoever these hackers were, were not using the same malware for every target.
They had three different backdoors that they were trying to get installed on their victims’
computers; Spark, SharpStage, and DropBook.
These would all allow hackers to take full control over their victims’ computers.
This gave them even more stuff to reverse-engineer and to look for clues and what other tools
the hackers might be using, and who they were.
Now, these viruses were interesting.
Let’s first look at SharpStage.
ASSAF: [MUSIC] Basically, once it’s installed on the victim’s machine, they can control
the machine, they can run arbitrary commands, fetch information, but what’s interesting
about it is the exfiltration method is using a Dropbox client, so they – the code itself,
in the code itself we found an implementation of a Dropbox client.
JACK: Once the hacker gets the information they needed from that computer they’re in,
they need to download that data.
You want to do that secretly so nobody notices you’re doing it, so how do you hide in the
shadows of the wires?
Well, they used Dropbox and sometimes Google Drive because so many people use Dropbox;
it would look like normal traffic and blend right in without detection.
Pretty clever.
ASSAF: Another interesting thing that we saw is that the backdoor itself was targeting
Arabic-speaking users, so one of the first things that the malware does was to check
whether Arabic language was installed on the infected machine.
If it wasn’t installed, the malware wouldn’t work, so it also – it’s also a clever
way to avoid most sandboxes, so if you uploaded it to VirusTotal or other online sandboxes,
it simply wouldn’t run because that default language is English, something that I think
people need to be more aware of ‘cause sometimes files may seem benign or they may seem like
they’re not doing much but once you dive into the code, you can see the reason behind
it. That was SharpStage.
The second backdoor that we discovered was DropBook and I think this is by far – I
think the most interesting one.
JACK: Okay, so this malware called DropBook was very similar.
Once it’s installed, it gives the hacker remote backdoor access into that computer
and it exfiltrates that data through Dropbox.
But what’s interesting with this one is how the hackers were able to control it remotely.
See, every piece of malware must get instructions on what it should do once it’s installed.
Sometimes it’s hard-coded in the malware itself but other times, malware reaches out
to another system to get those commands, asking what should I do?
That remote system will then tell them what to do.
You might think these remote systems issuing commands to backdoor viruses are some secret
and elaborate server somewhere, right?
Well, as it turned out with DropBook, it was just using Facebook to send commands to the
malware.
ASSAF: They actually used a Facebook fake account, so they created fake accounts on
Facebook.
Literally, when you look at the account, as you can see in our blog, there are – I mean,
these accounts don’t have any friends, interests, almost like zero details.
But what they do have is – they have posts that contain very obscure content.
Some of it is let’s say it could be encryption keys or it could be a Dropbox API key, but
we also found Windows commands that – to run for creating persistence and other things
like that.
So, that was I think one of the most I guess striking or shocking pieces that we uncovered
during this investigation.
Not only they were using let’s say Dropbox or Google Drive to hide in plain sight, if
you will, but that – I mean, a lot of threat actors do that but they actually implemented
a C2 communication channel using Facebook fake accounts which I think is pretty cool.
JACK: He calls it pretty cool.
It’s weird how defenders have a certain respect for the attackers and how they work,
because there really are so many similarities between the two, you know?
Both the hackers and defenders love technology.
They’re both computer geeks.
They love learning about ways to exploit systems.
The only thing that’s different is their motive on what to use computers for.
To be able to hunt for bad guys all day and to try to unravel their entire plot and expose
them, that’s pretty exciting.
ASSAF: [MUSIC] Well, first of all, the geopolitical aspect was quite interesting because as an
Israeli, you can’t be – you can’t stay indifferent, I guess, to what was going on
at the same time.
If we’re talking about October, November 2020, it was right around the same time where
Israel, with the help of the US, were signing peace accords or normalizations agreements
with Arab countries like the Emirates.
There were talks with the Saudis and so on.
So, you read about it in the news which is exciting on its own coming from my part of
the world, but once you see an actual attack that abuses this and you see that there are
political entities, let’s call it that way, that are trying to get intelligence, using
those backdoors as spyware to carry out espionage campaigns, about that topic made it super
interesting.
I mean, when we find something that is that exciting, we pull all-nighters, we sometimes
work weekends.
Not because I’m a slave driver or I make anyone put in extra hours; it’s just, it’s
so exciting and we’re on it.
As I told before, I’ve been in this business for over fifteen years now.
I still – when I wake up in the morning, I have this – I guess curiosity.
I think that’s the main drive.
It’s to solve problems, to solve mysteries.
To me, really uncovering new activity is very exciting.
JACK: They spent about ten months at this point tracking this threat actor, connecting
dots, watching activity, and they have a fairly good understanding of what this group is doing,
what their motivation is, and what tools they use.
Once Assaf and his team gets to this stage, they can use the research they just did to
enrich the Cybereason tools to make it so their endpoint detection tools can spot the
activity much quicker and more effectively.
Of course, they consult with the customer too to let them know that they found this
activity and this is what was going on, but the Nocturnus team doesn’t just stop there.
They’re a curious bunch of people, and so the question on everyone’s mind is who would
do such a thing?
Who exactly is behind this targeted hacking campaign?
Now, the victims appear to be highly targeted.
[MUSIC] This is not the result of some massive spam campaign.
No; specific individuals were sent these phishing e-mails to lure them into opening the attachment.
One way to try to figure out who’s behind an attack is to take everyone who could possibly
have done this and put them all together on a spreadsheet or something.
Eliminate all the ones that seem unlikely, so for instance, you might get a list of the
usual suspects here; cyber-criminals, hacktivists, governments around the world, mercenaries
for hire, and other APT groups.
But now what?
Well, the hacks didn’t seem to be financially motivated, and cyber-criminals typically are
in it to make money.
You can sort of rule out that whole group.
Next, you’re starting to look at who would have interest in these Arabic-speaking political
figures.
Well, there’s probably a bunch of nations around the world who simply don’t have any
interest with Palestine, so you can probably rule them out.
Now you’re left looking for who would have the motivation and the ability to hack into
these people, and it narrows down the list even further.
Now, again, you see why it’s so important to have geopolitical awareness to sort through
all this.
I can’t imagine the mental calculus that must go into figuring this out.
Just asking the question who would want to attack Palestine?
Well, a lot of people, including people in Palestine themselves.
I mean, just in 2007 they had a coup where Hamas used force to take over part of Palestine.
I’m sure that left a lot of unhappy residents there.
So, this gets pretty sticky to figure out.
But there were some clues that led Cybereason to believe they were dealing with a threat
actor called a Molerat.
ASSAF: [MUSIC] We knew that they’re a Arabic-speaking, politically-motivated group that has operated
in the Middle East since 2012.
They mostly targeted the Middle East and North Africa region but we’ve seen them also target
parliaments, for instance, in the US and Europe.
But most of their agenda seems around government entities, political activists, politician
diplomats.
JACK: Because the team at Cybereason understood the threat actors in this geopolitical space,
they started looking more into what this Molerat group does.
ASSAF: Molerats is quite a well-defined activity group and – or, some would call it adversary,
right?
The profile that – there have been reports on them for years, okay, so there’s a lot
of information about their modus operandi, like how they work, what malware do they use,
who are their targets.
JACK: Okay, so let’s look at some of those reports.
FireEye calls this group Molerats but Kaspersky calls this same group the Gaza Cyber Gang.
According to FireEye, their first attack was against the Israeli government where they
were able to take down the internet for the Israeli police force.
That campaign looked a lot like this one; a highly interesting e-mail was sent to a
specific target with the attachment that looked like a Word doc, and when you opened it, it
installed the backdoor.
It was a different backdoor they used back then but still, their tactics, techniques,
and procedures were the same.
But looking from there, I count fifty-one different threat intelligence reports by various
security companies who have investigated Molerats in the last nine years.
When you have a bunch of reports that lists a lot of different targets and you can see
who the threat actors were trying to hack into, it starts to paint a picture as to who
they might be.
[MUSIC] They have mostly targeted people in Palestine and Israel but they’ve also targeted
the US and UK and a few other countries.
But I did my best to look through these reports and never once do I see them list members
of Hamas as their targets, but they do target Fatah.
Hamas is the current acting government party of the Gaza Strip, a part of Palestine.
Fatah controls the West Bank, the other part of Palestine.
But Hamas and Fatah both struggle for power in Palestine.
So, from my research, my conclusion is that Molerats is somehow allied with Hamas.
Now, Hamas doesn’t have many allies.
I think only Qatar and Turkey have showed public support for them, but this activity
doesn’t lend way for me to believe that Molerats is from Qatar or Turkey.
Cybereason didn’t want to get into the specifics of who Molerats are exactly or who they might
even be, because nobody knows for sure and they don’t want to suggest something that’s
incorrect.
So, I’m not sure to what degree Molerats might be connected with Hamas, if at all.
But the evidence does suggest that they have aligned adversaries.
ASSAF: So, once we looked at the evidence of this new campaign and we correlate it to
our previous discoveries and we correlate it to other intelligence reports that were
published in the threat intel community and you look at the victims and you look at – you
consider geopolitical events, you can say that with, I don’t know, moderate to high
confidence that it’s likely Molerats who is behind it.
But again, I’ll state that there’s never or there – it’s very rare to have 100%
attribution if you’re not in intelligence agencies.
That’s why we always leave a margin for errors.
But that’s true for almost any intelligence report that you read that comes out of a vendor.
JACK: So, it’s fascinating to me that Molerats were targeting high-up Fatah officials and
stealing and collecting information from them.
ASSAF: In this context, the intelligence may give them leverage in certain negotiations
or let’s say if you’re not invited to the table, right, to take part of the discussion,
you want to know what’s going on on that – on the table, what was said there.
There could be many reasons why a certain entity would want to carry out an espionage
operation.
It could be to – but definitely to give them the advantage of knowing what they shouldn’t
know, and then they can do different things with that knowledge.
JACK: [MUSIC] That’s some shady, underhand, bad-guy behavior for sure; to hack into political
opponents’ computers just to spy on them, but that’s what so many governments around
the world are doing now.
It’s common knowledge that the NSA hacks into foreign governments all the time.
I guess the point is don’t trust anyone online, friends or enemies.
So, it’s fascinating to see how Cybereason is able to track these groups and publish
reports on them, and this helps make the world more secure because in their report, they
show tons of different indicators and signs that you might have Molerats in your network.
So, antivirus companies all over can create new signatures in their products and security
companies can detect their presence much quicker.
But on top of that, all this research makes Cybereason, the detection tools, more enriched
and robust at detecting bad behavior in the network.
ASSAF: Our product is, first and foremost of all – don’t kill me for the buzzwords,
right – but is AI-based using machine learning algorithms and mostly behavior – is based
on behavioral detection.
There are teams in Cybereason that are – I mean, that’s their daily job, to write detection
rules based off behavior.
The Nocturnus team, my team, as an intelligence team, we would pinpoint or we flag certain
techniques as let’s say more relevant or more interesting than others, but there are
a lot of teams that work together in Cybereason to make sure that we are able to detect things
behaviorally regardless to whether it’s a known or unknown threat.
LIOR: This is not just a big data analytic platform.
JACK: This is Lior again, the CEO of Cybereason.
LIOR: Today, Cybereason is operating in the EPP world; EDR, XDR, and NDR.
Basically, everything that related to detection and response anywhere in a big enterprise
environment, we know how to find and understand if there is hacking activity over there and
then basically prevent it.
So today, Cybereason has – we call it the Defense Platform.
It’s the most comprehensive platform that exists.
Really cover – enterprises.
We call it from endpoint to everywhere.
Really, the ability to see everything that hackers can do in an environment, monitor
it 24 by 7 and finding those malicious operation with the operation-centric approach.
We found out that the organization that – implementing and using this approach, basically they are
not just more safer; they are basically future-ready to deal with any attack.
JACK: Okay, yeah.
Tell me about the products you have and what solutions you have.
LIOR: Today we have full protection on the endpoint.
The way that Cybereason think about protecting an organization; we call it from endpoint
to everywhere, so it started by deploying the sensor on every endpoint that the company
has.
Over there, we have everything from antivirus, next-gen antivirus, anti-ransomware, anti-virus
attack, really the ability to prevent everything that is malicious on those endpoints.
But we’re not stopping there.
This is just the beginning.
Then we know how to collect data from each and every one of those system in real time.
We collect all the data, unfiltered, send this data into our Cloud architecture, and
over there we’re running the graph processing in real time.
Basically, we collect data from every endpoint that the organization has and then we’re
analyzing all the data in real time.
Basically, what we are doing; we are creating – building the network of relationship between
everything to everything.
So, every process that’s communicating with another process, every connection that’s
going in and out of the environment.
Think about it as a big graph that we’re basically painting while the data is flowing.
So, this has really enabled us to really understand the interaction of every process, every machine,
every user with the world and within the inner groups.
So, every deviation from abnormality, we know how to identify and we call it evidence.
So, let’s say that the process usually communicated with x amount of processes and suddenly it’s
deviating from the normality.
We’re – mark it as evidence.
Let’s say that there is a connection between two computers that usually are not communicated;
started to become communicated.
We’re gonna mark it as evidence as well.
So, the system is collecting endless amount of evidence as the data flows through the
system, and then try to evolve the evidence to suspicions, basically to correlate multiple
evidence together to a suspicion.
Once there is enough suspicions, then we collect them and correlate them to a malicious operation.
When Cybereason is triggering hey, there is a malicious operation right now and we stopped
it, we can tell the full story of what’s happened, so this has really enabled us to
go back and show you all the points and everything that the hackers did in order to be able to
really understand what they did, then we show how we blocked it, and then you can basically
improve your capability in order to do better in the future.
JACK: So, are you still disappointed you didn’t get to fly fighter jets?
LIOR: Running Cybereason every day, it’s like flying a jet every day.
So, you don’t need to do it in reality.
You can do it in the cyber world.
(OUTRO): [OUTRO MUSIC] A big thank-you to Cybereason for sponsoring this episode.
They obviously have a very sharp and skilled team over there which is doing a great job
at making their customers more secure.
Remember their first customer they had when they found a whole bunch of malicious activity
in the network?
Yeah, well, all these years later, they’re still a customer of Cybereason.
Cybereason doesn’t just operate in the Middle East.
They have offices all over the world; Boston, Tokyo, London, Tel Aviv, and France.
If you’re interested in learning more or even want a demo of their products, visit
cybereason.com.
This show is made by me, the pizza rat, Jack Rhysider.
Sound design this episode by the memory-intensive Andrew Meriwether, editing help this episode
by the backlit Damienne, and our theme music is by the perpetual machine known as Breakmaster
Cylinder.
Even though when I was a little kid I used to watch cartoons where bears lived up in
the clouds, but the reality is Molerats live in the Clouds.
This is Darknet Diaries.