Gaza Cybergang Group1, operation SneakyPastes

[harlan4096]

CONTENTS
Summary
Technical analysis
Spreading
Intrusion life-cycle analysis
Embedded functions
Malware features
Infrastructure
Victimology
Conclusions
Appendix I – Main historical checkpoints and politicized decoys Gaza Cybergang Group1 2016-2019
Appendix II – Indicators of compromise

Gaza Cybergang(s) is a politically motivated Arabic-language cyberthreat actor, actively targeting the MENA (Middle East North Africa) region, especially the Palestinian Territories.

The confusion surrounding Gaza Cybergang’s activities, separation of roles and campaigns has been prevalent in the cyber community. For a while, the gang’s activities seemed scattered, involving different tools and methods, and different malware and infection stages, although there was an alignment in its goals…

During our 2018 monitoring of this group, we were able to identify different techniques utilized by very similar attackers in the MENA region, sometimes on the same target. The findings led to us distinguishing between three attack groups operating within Gaza Cybergang:

*Gaza Cybergang Group1 (classical low-budget group), also known as MoleRATs;
*Gaza Cybergang Group2 (medium-level sophistication) with links to previously known Desert Falcons;
*Gaza Cybergang Group3 (highest sophistication) whose activities previously went by the name Operation Parliament.

The groups use different styles and, in some cases, techniques, but deploy common tools and commands after initial infection. The three attack groups were identified sharing victims. For example, Group1 would deploy a script to infect a specific victim with malware belonging to Group2, or similarly between Group2 and Group3.

More information on previous Desert Falcons (Group2) and Operation Parliament (Group3) activities can be found below:

* Group2: ‘The Desert Falcons targeted attacks‘
* Group3: ‘Operation Parliament, who is doing what?‘

Additional findings on Gaza Cybergang Group2 and Group3 will be presented in future publications. For more information, please contact: intelreports@kaspersky.com

Continue Reading