High-ranking Israeli officials are being catfished in a new cyberespionage campaign launched by AridViper.
AridViper, also known as APT-C-23, Desert Falcon, and Two-tailed Scorpion, is a politically-driven advanced persistent threat (APT) group active in the Middle East.
In the past, AridViper has conducted spear-phishing attacks against Palestinian law enforcement, military, and educational establishments, as well as the Israel Security Agency (ISA). In February, Cisco Talos researchers uncovered AridViper attacks against activists associated with the Israel-Palestine conflict.
On Thursday, Cybereason’s Nocturnus Research Team published new findings on the APT’s latest activities.
Dubbed “Operation Bearded Barbie,” the latest campaign targets “carefully chosen” Israeli individuals to compromise their PCs and mobile devices, spy on their activities, and steal sensitive data.
The researchers say the AridViper group, alongside MoleRATs, are subset APTs of the Hamas cyberwarfare division and are working to benefit the Palestinian political group.
The operation’s victims include individuals working in Israel’s defense, law enforcement, and emergency service sectors.
According to Cybereason, the first step in AridViper attacks relies on social engineering: after conducting reconnaissance on a victim, the group creates fake Facebook social media accounts, makes contact, and tries to entice the target to download Trojanized message apps.
In some cases, the catfish profiles are created to appear to be young women.
Chats move from Facebook to WhatsApp, and from there, the catfish suggests a more ‘discrete’ messaging service. Another attack vector is the lure of a sexual video packaged up in a malicious .RAR achive.
The APT has also upgraded its cyber weaponry. In particular, two new tools — Barb(ie) Downloader and BarbWire Backdoor — and a new implant variant, VolatileVenom, are worth exploring.
Barb(ie) Downloader is delivered through the lure video and is used to install the BarbWire backdoor. The malware will perform several anti-analysis checks, including a scan for virtual machines (VMs) or the presence of sandboxes, before going ahead with the backdoor installation. Barb(ie) will also collect basic OS information and send it to the attacker’s command-and-control (C2) server.
The BarbWire Backdoor is described as a “very capable” malware strain with high levels of obfuscation achieved through string encryption, API hashing, and process protection.
BarbWire performs various surveillance functions, including keylogging, screen capture, and audio eavesdropping & recording. In addition, the malware variant can maintain persistence on an infected device, schedule tasks, encrypt content, download additional malware payloads, and exfiltrate data.
The backdoor will specifically look for Microsoft Office documents, .PDF files, archives, images, and videos on the compromised machine and any connected external drives.
Cybereason also spotted new VolatileVenom variants. VolatileVenom is Android malware served during the installation of the ‘discrete’ messaging app and has been designed to perform surveillance and theft.
VolatileVenom can compromise an Android device’s microphone and audio functions, record calls and tests made over WhatsApp, read notifications from WhatsApp, Facebook, Telegram, Instagram, Skype, IMO, and Viber; read contact lists, and steal information including SMS messages, files, and app credentials.
In addition, the malware can extract call logs, use the camera to take photos, tamper with WiFi connections, and download files to the device.
“The “tight grip” on their targets attests to how important and sensitive this campaign was for the threat actors,” Cybereason commented. “This campaign shows a considerable step-up in APT-C-23/AridViper capabilities, with upgraded stealth, more sophisticated malware, and perfection of their social engineering techniques which involve offensive HUMINT capabilities using a very active and well-groomed network of fake Facebook accounts that have been proven quite effective for the group.”
Previous and related coverage
Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0
