Yemen Cyber Army promises more attacks, but are they a front for Iran?
A group calling itself the Yemen Cyber Army has said that it will be stepping up its attacks on Saudi targets: this group is thought to have beenbehind the posting on Wikileaks of sensitive Saudi government documents last May. &nbsp;Now there are suggestions that at least some of the malware used originates from Iran directly: &nbsp;Boaz Dolev, the head of the cybersecurity firm ClearSky, said that they had identified a piece of malware that they believe was used in the hacks against the Saudi foreign ministry, and are almost certain was made by the Iranian government. What originally was termed the cyber-jihad is rapidly becoming a developing front in proxy-wars.
“We estimate that this access is used for espionage or other nation-state interests, and not for monetary gain or hacktivism,” Dolev wrote in a recently released report. “Various characteristics of the attacks and their targets bring us to the conclusion that the threat actors are Iranian,” he wrote. “The attackers speak and write in native Iranian Persian and make mistakes characteristic of Persian speakers. In one of the hacked accounts, when retrieved, the interface language had been changed to Persian.”



Dolev added that several of the IP addresses were traced back to locations in Iran. While his evidence seems strong, in the games of smoke and mirrors that get played in cyberespionage, countries can insert deceiving language or fake IP addresses to try to scapegoat another country. What seems certain, Dolev said, was that a nation-state was behind what he called “sophisticated and aggressive malware.” He said the attacks followed a pattern: First a targeted “spear-phishing” email designed to gain the trust of the target would be sent loaded with the malware that his firm has been tracking; then if that didn’t work more sophisticated follow-up attacks, ranging from false Gmail logins to YouTube pages, would be sent in an effort to access the target’s systems and install the malware.

Once installed, the malware entered the target's system, then gained access to the targets’ emails, documents, and other forms of communication, which the malware’s creator could then remotely access and copy. The ClearSky report concluded that it appeared to be built for espionage, as the malware exists in a computer without overtly malicious side effects and does not destroy the data it accesses.

The malware, which ClearSky calls Gholee, has other names among other cybersecurity companies, several of which likewise found links between it and Iran. The Tokyo-based cybersecurity company TrendMicro, found the malware in an Iranian-linked campaign they call Operation Woolen-Goldfish. The U.S.-based FireEye cybersecurity firm has connected the malware to a group they call the Ajax Security team, which they also conclude is based in Iran.

ClearSky, TrendMicro, and FireEye all concluded that it was likely the Iranian government behind the malware, rather than individuals in Iran, due to the resources and amount of time it would take to develop. Though Iran is hardly public about its cyberwarfare capabilities, researchers don’t believe Iran has the same type of organized pseudo-governmental hacking collectives that exist in China and Russia. In August 2012, when malware struck Saudi Aramco, the NSA concluded that the Iranian government was behind the malware, nicknamed Shamoon. They had created it, according to one NSA document, by mimicking a piece of malware (likely U.S.- or Israel-made) that years earlier had attacked and wiped clean computers in Iran’s oil ministry.

Dolev said that without looking through the computers at Saudi Arabia’s foreign ministry for evidence of Gholee in their systems, it was impossible to say with total certainty that they had been infected by the same malware his company has been tracing.

“I would say I am 90% certain, given the timing and the sophistication of this malware,” he said.

BuzzFeed News repeatedly asked Saudi officials if they could confirm that the malware identified by the cybersecurity companies was the same as that which infected the foreign ministry’s computers. Saudi officials, speaking through the country’s official press agency, said an investigation was ongoing, but refused to comment further. An official who answered the phone in Saudi Arabia’s interior ministry said that “sophisticated malware” had infected computers through a spear-phishing attack, though he declined to be named, saying he was not allowed to speak to journalists.