Article Content Gaza Cybergang(s) is a politically motivated Arabic-language cyberthreat actor, actively targeting the MENA (Middle East North Africa) region, especially the Palestinian Territories The confusion surrounding Gaza Cybergang’s activities, separation of roles and campaigns has been prevalent in the cyber community For a while, the gang’s activities seemed scattered, involving different tools and methods, and different malware and infection stages, although there was an alignment in its goals… During our 2018 monitoring of this group, we were able to identify different techniques utilized by very similar attackers in the MENA region, sometimes on the same target The findings led to us distinguishing between three attack groups operating within Gaza Cybergang:  Gaza Cybergang Group1 (classical low-budget group), also known as MoleRATs; Gaza Cybergang Group2 (medium-level sophistication) with links to previously known Desert Falcons; Gaza Cybergang Group3 (highest sophistication) whose activities previously went by the name Operation Parliament The groups use different styles and, in some cases, techniques, but deploy common tools and commands after initial infection The three attack groups were identified sharing victims For example, Group1 would deploy a script to infect a specific victim with malware belonging to Group2, or similarly between Group2 and Group3 More information on previous Desert Falcons (Group2) and Operation Parliament (Group3) activities can be found below:  Group2: ‘The Desert Falcons targeted attacks‘ Group3: ‘Operation Parliament, who is doing what?‘  Additional findings on Gaza Cybergang Group2 and Group3 will be presented in future publications For more information, please contact: intelreports@kaspersky.com Summary Gaza Cybergang Group1, described in this post, is the least sophisticated of the three attack groups and relies heavily on the use of paste sites (with the operation name SneakyPastes) in order to gradually sneak a remote access Trojan (RAT) or multiple, onto victim systems The group has been seen employing phishing, with several chained stages to evade detection and extend command and control server lifetimes The most popular targets of SneakyPastes are embassies, government entities, education, media outlets, journalists, activists, political parties or personnel, healthcare and banking In this post, we’ll take a closer look at Gaza Cybergang Group1, including:  Updated 2018/2019 tactics, techniques and procedures Victimology of the group between Jan 2018 and Jan 2019 Historical checkpoints and politicized graphical decoys in Appendix I Full list of indicators of compromise in Appendix II  Technical analysis Through our continuous monitoring of threats during 2018, we observed a new wave of attacks by Gaza Cybergang Group1 targeting embassies and political personnel Gaza Cybergang Group1 is an attack group with limited infrastructure and an open-source type of toolset, which conducts widespread attacks, but is nevertheless focused on Palestinian political problems The attackers rely a lot on chained attack stages to evade quick detection and hide the communication infrastructure After an analysis of the samples, and through collaboration efforts with law enforcement agencies, we were able to uncover the full cycle of the intrusions that spread across the majority of the cyber kill chain, including but not limited to the toolset used, TTPs, infrastructure, action on objectives and the victimology These efforts have led to the takedown of a large portion of the related infrastructure In this campaign, Gaza Cybergang used disposable emails and domains as the phishing platform to target the victims We have identified several implants that leveraged PowerShell, VBS, JS, and dotnet for resilience and persistence The final stage, however, is a dotnet application that takes several commands such as directory listing, screenshot, compress, upload, etc It then creates random long string folder names in temp directories to host the collected files per category before compressing, encrypting and uploading to the C2 server Spreading The threat actor seemed able to spread attacks widely, but only deployed additional tools and data collection functions in specific cases, as though they had a target list or a filter for targeted victims These were necessary to lure the intended type of victims – people involved in politics Intrusion life-cycle analysis The diagram below displays at a high level the steps taken by typical Gaza Cybergang Group1 lure samples While different samples may use different methods to infect (i.e invoke PowerShell, VBS, .NET app downloader, etc.), they generally stick to the same scenario of a persistent RAT that steals data and uploads it to the C2 server despite the different hard-coded domains The analyzed samples had a lot of similarities in terms of the code used and especially in the persistence techniques Malware features All the stages’ executables are created as chains to avoid detection and protect the C2 server Command Brief Description   KEYWORD Downloads encrypted strings found on the /Feed server page that represents specific keywords of interest which, if found, then compresses/encrypts using Winrar appending “Keyword” in the file name and uploading to the C2 using a POST command at the path “/FeedBack.php” KEY Trigger to upload all data gathered to the C2 using a POST command at the path “/log.php” REUPLOAD Re-uploads recent data to the C2 server using POST at the path “/FeedBack.php” RESTARTME Restarts the RAT application process BLOCK Creates a file in the Temp path and names it “Block~” + PCID to kill the RAT LAN Creates a file in the Temp path and names it “LA” + PCID to possibly spread through LAN Note: this seems to refer to an unloaded feature/module of the RAT that is not currently in use USB Creates a file in the Temp path and names it “us” + PCID then invokes another program module named Remo.test to identify removable drives KILL Kills system processes Infrastructure In 2018, the threat actor mostly relied on a single C2 server (192.169.7.250) and rotated a multitude of domain names over a period of time The phishing email infrastructure though relied on disposable email providers such as bit-degree.com, mail4gmail.com, careless-whisper.com and others Victimology Based on the analyzed metrics, the victims were spread across 39 countries and reached 240+ unique victims The Palestinian Territories host the majority of the victims, followed by Jordan, Israel, then Lebanon, as noted in the below table The most targeted entities are embassies, government entities, education, media outlets, journalists, activists, political parties or personnel, healthcare and banking Country Number of victims   Palestinian Territories 110   Jordan 25   Israel 17   Lebanon 11   Saudi Arabia 9   Syria 9   Egypt 7   UAE 6   Senegal, France, Germany, Iran, Malaysia, Belgium, Bosnia and Herzegovina, Libya, Morocco, Spain, Sri Lanka, Tunisia, Afghanistan, Armenia, Azerbaijan, Cyprus, India, Indonesia, Iraq, Ireland, Italy, Kuwait, Oman, Poland, Romania, Russia, Serbia, Slovenia, Sudan, UK, USA < 5    Conclusions While Gaza Cybergang Group1 described in this post looks like a low sophistication group, with limited infrastructure and attack files that can be found in the wild, they are the most relentless in their attacks, with continuous targeting and high malleability This has allowed the group to achieve reasonable success against a relatively wide array of victims Gaza Cybergang is evolving and adapting to the MENA region – a complex setting with complex requirements The attacks are now divided into three groups with different levels of sophistication and different levels of targeting We expect the damage caused by these groups to intensify and the attacks to extend into other regions that are also linked to the complicated Palestinian situation The attackers also seem to be within reach of more advanced tools, techniques and procedures, and we expect them to rely more on these in future attacks More information on Desert Falcons (Group2) and Operation Parliament (Group3) will be presented in future publications Wiknet.wikaba.com (104.200.67.190) Wiknet.mooo.com   55d33d9da371fdfe7871f2479621444a May 2016 نموذج ترشيج الدورة الخاصة .rar  Translation: Form for private training selection Application for a certain legal training program for judges in the UAE dw.downloadtesting.com (185.117.75.105)   e782610bf209e81ecc42ca94b9388580 July 2016 عاجل – مؤتمر ايران.exe  Translation: Urgent – Iran conference dw.downloadtesting.com (185.117.75.105)   5db18ab35d29d44dda109f49d1b99f38 June 2017 פרצת פרטיות בכרום מאפשרת לאתרים להקליט אתכם ללא ידיעתכם.exe  Translation: A privacy breach in Chrome allows sites to record you without your knowledge Wiknet.wikaba.com (104.200.67.190) wiknet.mooo.com   Dae24e4d1dfcdd98f63f7de861d95182 June 2017 مراسلات العتيبة
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content Gaza Cybergang(s) is a politically motivated Arabic-language cyberthreat actor, actively targeting the MENA (Middle East North Africa) region, especially the Palestinian Territories The confusion surrounding Gaza Cybergang’s activities, separation of roles and campaigns has been prevalent in the cyber community For a while, the gang’s activities seemed scattered, involving different tools and methods, and different malware and infection stages, although there was an alignment in its goals… During our 2018 monitoring of this group, we were able to identify different techniques utilized by very similar attackers in the MENA region, sometimes on the same target The findings led to us distinguishing between three attack groups operating within Gaza Cybergang:  Gaza Cybergang Group1 (classical low-budget group), also known as MoleRATs; Gaza Cybergang Group2 (medium-level sophistication) with links to previously known Desert Falcons; Gaza Cybergang Group3 (highest sophistication) whose activities previously went by the name Operation Parliament The groups use different styles and, in some cases, techniques, but deploy common tools and commands after initial infection The three attack groups were identified sharing victims For example, Group1 would deploy a script to infect a specific victim with malware belonging to Group2, or similarly between Group2 and Group3 More information on previous Desert Falcons (Group2) and Operation Parliament (Group3) activities can be found below:  Group2: ‘The Desert Falcons targeted attacks‘ Group3: ‘Operation Parliament, who is doing what?‘  Additional findings on Gaza Cybergang Group2 and Group3 will be presented in future publications For more information, please contact: intelreports@kaspersky.com Summary Gaza Cybergang Group1, described in this post, is the least sophisticated of the three attack groups and relies heavily on the use of paste sites (with the operation name SneakyPastes) in order to gradually sneak a remote access Trojan (RAT) or multiple, onto victim systems The group has been seen employing phishing, with several chained stages to evade detection and extend command and control server lifetimes The most popular targets of SneakyPastes are embassies, government entities, education, media outlets, journalists, activists, political parties or personnel, healthcare and banking In this post, we’ll take a closer look at Gaza Cybergang Group1, including:  Updated 2018/2019 tactics, techniques and procedures Victimology of the group between Jan 2018 and Jan 2019 Historical checkpoints and politicized graphical decoys in Appendix I Full list of indicators of compromise in Appendix II  Technical analysis Through our continuous monitoring of threats during 2018, we observed a new wave of attacks by Gaza Cybergang Group1 targeting embassies and political personnel Gaza Cybergang Group1 is an attack group with limited infrastructure and an open-source type of toolset, which conducts widespread attacks, but is nevertheless focused on Palestinian political problems The attackers rely a lot on chained attack stages to evade quick detection and hide the communication infrastructure After an analysis of the samples, and through collaboration efforts with law enforcement agencies, we were able to uncover the full cycle of the intrusions that spread across the majority of the cyber kill chain, including but not limited to the toolset used, TTPs, infrastructure, action on objectives and the victimology These efforts have led to the takedown of a large portion of the related infrastructure In this campaign, Gaza Cybergang used disposable emails and domains as the phishing platform to target the victims We have identified several implants that leveraged PowerShell, VBS, JS, and dotnet for resilience and persistence The final stage, however, is a dotnet application that takes several commands such as directory listing, screenshot, compress, upload, etc It then creates random long string folder names in temp directories to host the collected files per category before compressing, encrypting and uploading to the C2 server Spreading The threat actor seemed able to spread attacks widely, but only deployed additional tools and data collection functions in specific cases, as though they had a target list or a filter for targeted victims These were necessary to lure the intended type of victims – people involved in politics Intrusion life-cycle analysis The diagram below displays at a high level the steps taken by typical Gaza Cybergang Group1 lure samples While different samples may use different methods to infect (i.e invoke PowerShell, VBS, .NET app downloader, etc.), they generally stick to the same scenario of a persistent RAT that steals data and uploads it to the C2 server despite the different hard-coded domains The analyzed samples had a lot of similarities in terms of the code used and especially in the persistence techniques Malware features All the stages’ executables are created as chains to avoid detection and protect the C2 server Command Brief Description   KEYWORD Downloads encrypted strings found on the /Feed server page that represents specific keywords of interest which, if found, then compresses/encrypts using Winrar appending “Keyword” in the file name and uploading to the C2 using a POST command at the path “/FeedBack.php” KEY Trigger to upload all data gathered to the C2 using a POST command at the path “/log.php” REUPLOAD Re-uploads recent data to the C2 server using POST at the path “/FeedBack.php” RESTARTME Restarts the RAT application process BLOCK Creates a file in the Temp path and names it “Block~” + PCID to kill the RAT LAN Creates a file in the Temp path and names it “LA” + PCID to possibly spread through LAN Note: this seems to refer to an unloaded feature/module of the RAT that is not currently in use USB Creates a file in the Temp path and names it “us” + PCID then invokes another program module named Remo.test to identify removable drives KILL Kills system processes Infrastructure In 2018, the threat actor mostly relied on a single C2 server (192.169.7.250) and rotated a multitude of domain names over a period of time The phishing email infrastructure though relied on disposable email providers such as bit-degree.com, mail4gmail.com, careless-whisper.com and others Victimology Based on the analyzed metrics, the victims were spread across 39 countries and reached 240+ unique victims The Palestinian Territories host the majority of the victims, followed by Jordan, Israel, then Lebanon, as noted in the below table The most targeted entities are embassies, government entities, education, media outlets, journalists, activists, political parties or personnel, healthcare and banking Country Number of victims   Palestinian Territories 110   Jordan 25   Israel 17   Lebanon 11   Saudi Arabia 9   Syria 9   Egypt 7   UAE 6   Senegal, France, Germany, Iran, Malaysia, Belgium, Bosnia and Herzegovina, Libya, Morocco, Spain, Sri Lanka, Tunisia, Afghanistan, Armenia, Azerbaijan, Cyprus, India, Indonesia, Iraq, Ireland, Italy, Kuwait, Oman, Poland, Romania, Russia, Serbia, Slovenia, Sudan, UK, USA < 5    Conclusions While Gaza Cybergang Group1 described in this post looks like a low sophistication group, with limited infrastructure and attack files that can be found in the wild, they are the most relentless in their attacks, with continuous targeting and high malleability This has allowed the group to achieve reasonable success against a relatively wide array of victims Gaza Cybergang is evolving and adapting to the MENA region – a complex setting with complex requirements The attacks are now divided into three groups with different levels of sophistication and different levels of targeting We expect the damage caused by these groups to intensify and the attacks to extend into other regions that are also linked to the complicated Palestinian situation The attackers also seem to be within reach of more advanced tools, techniques and procedures, and we expect them to rely more on these in future attacks More information on Desert Falcons (Group2) and Operation Parliament (Group3) will be presented in future publications Wiknet.wikaba.com (104.200.67.190) Wiknet.mooo.com   55d33d9da371fdfe7871f2479621444a May 2016 نموذج ترشيج الدورة الخاصة .rar  Translation: Form for private training selection Application for a certain legal training program for judges in the UAE dw.downloadtesting.com (185.117.75.105)   e782610bf209e81ecc42ca94b9388580 July 2016 عاجل – مؤتمر ايران.exe  Translation: Urgent – Iran conference dw.downloadtesting.com (185.117.75.105)   5db18ab35d29d44dda109f49d1b99f38 June 2017 פרצת פרטיות בכרום מאפשרת לאתרים להקליט אתכם ללא ידיעתכם.exe  Translation: A privacy breach in Chrome allows sites to record you without your knowledge Wiknet.wikaba.com (104.200.67.190) wiknet.mooo.com   Dae24e4d1dfcdd98f63f7de861d95182 June 2017 مراسلات العتيبة ### Response: .