Low-tech attackers harness open source security tools for targeted cyberespionage

Woburn, MA – April 27, 2016 –Kaspersky Lab researchers have uncovered a new trend among cyberespionage threat actors: instead of developing customized hacking tools or buying them from third-party suppliers on the criminal underground, they are using tools available on the web for research purposes. Several cyberespionage campaigns utilizing such tools have been spotted recently by experts.

This trend demonstrates that not only is the price of dangerous cyberattack tools falling; the tools are becoming more effective, and their accessibility higher. This means that even less-professional, less-skilled and less-resourced hacker groups can now pose a threat to users and companies. Moreover, the use of legitimate tools for pen-testing makes such attacks less visible to security solutions.

The browser exploitation framework, or BeEF, is one such tool. Originally developed by the security community to make the security testing of browsers better and easier, it is now used by several cyberespionage groups to attack targets around the world.

To exploit vulnerabilities in targets’ browsers, the hackers compromise websites of interest, plant BeEF on it, and then just wait for potential victims to visit these websites. The BeEF content enables the precise identification of both system and user and allows for the exploitation and theft of authentication credentials which in turn enable additional malware to be downloaded to a compromised device, and more. This infection tactic is called setting up a watering hole and is often used by cyberespionage actors.

During their research, the Kaspersky Lab specialists were able to identify tens of such “watering hole” websites. The nature and topics of these websites reveals a lot about the types of potential targets:

• Middle-eastern embassy in the Russian Federation
• Indian military technology school
• Regional presidency office
• Ukrainian ICS Scanner mirror
• European Union education diversification support agency
• Russian foreign trade management organization
• Progressive Kazakh news and political media
• Turkish news organization
• Specialized German music school
• Japanese textile manufacturing inspection organization
• Middle Eastern social responsibility and philanthropy
• Popular British "lifestyle" blog
• Algerian University's online course platform
• Chinese construction group
• Russian overseas business development and holding company
• Russian gaming developer forum
• Romanian Steam gaming developer
• Chinese online gaming virtual gold seller
• Brazilian music instrument retailer

“Previously we’ve seen cyberespionage groups using different open-sourced, legitimate pentesting tools, either in combination with their own malware or without it. What is different now is that we’re seeing more and more groups using BeEF as an attractive and effective alternative. This fact should be taken into account by corporate security departments in order to protect the organization from this new threat vector,” - said Kurt Baumgartner, principal security researcher at Kaspersky Lab.

Read more about the malicious usage of BeEF and other legitimate offensive tools by threat actors like Newsbeef/Newscaster, Crouching Yeti, and TeamSpy APT, and how to protect from such attacks at Securelist.com.

About Kaspersky Lab

Kaspersky Lab is a global cybersecurity company founded in 1997. Kaspersky Lab’s deep threat intelligence and security expertise is constantly transforming into security solutions and services to protect businesses, critical infrastructure, governments and consumers around the globe. The company’s comprehensive security portfolio includes leading endpoint protection and a number of specialized security solutions and services to fight sophisticated and evolving digital threats. Over 400 million users are protected by Kaspersky Lab technologies and we help 270,000 corporate clients protect what matters most to them. Learn more at www.kaspersky.com.

For the latest in-depth information on security threat issues and trends, please visit:

Securelist | Information about Viruses, Hackers and Spam
Follow @Securelist on Twitter

Threatpost | The First Stop for Security News
Follow @Threatpost on Twitter

Media Contact:
Sarah Kitsos
781.503.2615
sarah.kitsos@kaspersky.com