Article Content Summary Kaspersky Lab has been tracking a series of attacks utilizing unknown malware since early 2017 The attacks appear to be geopolitically motivated and target high profile organizations The objective of the attacks is clearly espionage – they involve gaining access to top legislative, executive and judicial bodies around the world The attackers have targeted a large number of organizations globally since early 2017, with the main focus on the Middle East and North Africa (MENA), especially Palestine High-profile organizations have also been targeted in other regions The number of attacks has decreased since the beginning of 2018 The attacks were initially discovered while investigating a phishing attack that targeted political figures in the MENA region At first the attacks looked to be the work of the low-sophistication Gaza Cybergang (decoys, file names), but further analysis painted a very different picture Targets include high-profile entities such as parliaments, senates, top state offices and officials, political science scholars, military and intelligence agencies, ministries, media outlets, research centers, election commissions, Olympic organizations, large trading companies, and other unknown entities Kaspersky Lab users and Threat Management and Defense clients are protected from the attacks Cisco Talos recently published a blogpost describing targeted attacks in the Middle East region which we believe may be connected Victimology and Statistics Based on our findings, we believe the attackers represent a previously unknown geopolitically motivated threat actor The campaign started in 2017, with the attackers doing just enough to achieve their goals They most likely have access to additional tools when needed and appear to have access to an elaborate database of contacts in sensitive organizations and personnel worldwide, especially of vulnerable and non-trained staff The victim systems range from personal desktop or laptop systems to large servers with domain controller roles or similar The nature of the targeted ministries varied, including those responsible for telecommunications, health, energy, justice, finance and so on Victims have been spotted in the Palestinian Territories, Egypt, Jordan, the UAE, Saudi Arabia, Djibouti, Qatar, Lebanon, Chile, Somalia, Iraq, Morocco, Syria, India, Iran, Canada, the USA, the UK, Germany, Israel, Afghanistan, Serbia, Russia, Oman, Kuwait, South Korea and Denmark Victim organization type Number of victim organizations   Unknown 91   Senates/Parliaments 7   Prime Ministerial Offices 3   Military/Intelligence Agencies 5   Other Gov./Ministerial/Diplomatic Offices 20   Financial/Banking Institutions 5   Media Outlets 2   Olympic/Sports Bodies 2   Research Centers/Scholars 2   Election Commissions 1   Distribution/Logistics 1     The number of victims/victim organizations probably doesn’t represent the full scope of the attacks – only a portion Attack description and attribution Operation Parliament appears to be another symptom of escalating tensions in the Middle East region The attackers have taken great care to stay under the radar, imitating another attack group in the region They have been particularly careful to verify victim devices before proceeding with the infection, safeguarding their command and control servers The targeting seems to have slowed down since the beginning of 2018, probably winding down when the desired data or access was obtained The targeting of specific victims is unlike previously seen behavior in regional campaigns by Gaza Cybergang or Desert Falcons and points to an elaborate information-gathering exercise that was carried out before the attacks (physical and/or digital) With deception and false flags increasingly being employed by threat actors, attribution is a hard and complicated task that requires solid evidence, especially in complex regions such as the Middle East Functionality was identified that enables HTTP communication with the C&C server and invokes “processcreate” based on parameters received as a response Data sent to the C&C server is also encrypted using 3DES and Base64 Different keys are used for local and network encryption The malware starts communicating with the C&C server by sending basic information about the infected machine Sample of the C&C response with encrypted commands and configurations Examples of attack decoys Translation: Contacts list of media personnel Translation: Relations between UAE and Jordan, and the impact caused by the non-boycott of Qatar Translation: Military retirement statement 2017 June Translation: The new Hamas structure for Gaza strip 2017 Translation: Clarification report (on Gaza employee salaries) What should high-profile organizations do? High-profile organizations should have elevated levels of cybersecurity Attacks against them are inevitable and are unlikely to ever cease These organizations need to pay particular attention to their security, implementing additional measures to ensure they are well protected Anti-targeted attack solutions, threat intelligence capabilities and data flows, default-deny application lockdown, endpoint detection and response, data leak and insider threat prevention, and even isolated/air-gapped networks should form the basis of any strategy for protecting organizations in the current threat landscape The victims of Operation Parliament need to re-evaluate their approach to cybersecurity 
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content Summary Kaspersky Lab has been tracking a series of attacks utilizing unknown malware since early 2017 The attacks appear to be geopolitically motivated and target high profile organizations The objective of the attacks is clearly espionage – they involve gaining access to top legislative, executive and judicial bodies around the world The attackers have targeted a large number of organizations globally since early 2017, with the main focus on the Middle East and North Africa (MENA), especially Palestine High-profile organizations have also been targeted in other regions The number of attacks has decreased since the beginning of 2018 The attacks were initially discovered while investigating a phishing attack that targeted political figures in the MENA region At first the attacks looked to be the work of the low-sophistication Gaza Cybergang (decoys, file names), but further analysis painted a very different picture Targets include high-profile entities such as parliaments, senates, top state offices and officials, political science scholars, military and intelligence agencies, ministries, media outlets, research centers, election commissions, Olympic organizations, large trading companies, and other unknown entities Kaspersky Lab users and Threat Management and Defense clients are protected from the attacks Cisco Talos recently published a blogpost describing targeted attacks in the Middle East region which we believe may be connected Victimology and Statistics Based on our findings, we believe the attackers represent a previously unknown geopolitically motivated threat actor The campaign started in 2017, with the attackers doing just enough to achieve their goals They most likely have access to additional tools when needed and appear to have access to an elaborate database of contacts in sensitive organizations and personnel worldwide, especially of vulnerable and non-trained staff The victim systems range from personal desktop or laptop systems to large servers with domain controller roles or similar The nature of the targeted ministries varied, including those responsible for telecommunications, health, energy, justice, finance and so on Victims have been spotted in the Palestinian Territories, Egypt, Jordan, the UAE, Saudi Arabia, Djibouti, Qatar, Lebanon, Chile, Somalia, Iraq, Morocco, Syria, India, Iran, Canada, the USA, the UK, Germany, Israel, Afghanistan, Serbia, Russia, Oman, Kuwait, South Korea and Denmark Victim organization type Number of victim organizations   Unknown 91   Senates/Parliaments 7   Prime Ministerial Offices 3   Military/Intelligence Agencies 5   Other Gov./Ministerial/Diplomatic Offices 20   Financial/Banking Institutions 5   Media Outlets 2   Olympic/Sports Bodies 2   Research Centers/Scholars 2   Election Commissions 1   Distribution/Logistics 1     The number of victims/victim organizations probably doesn’t represent the full scope of the attacks – only a portion Attack description and attribution Operation Parliament appears to be another symptom of escalating tensions in the Middle East region The attackers have taken great care to stay under the radar, imitating another attack group in the region They have been particularly careful to verify victim devices before proceeding with the infection, safeguarding their command and control servers The targeting seems to have slowed down since the beginning of 2018, probably winding down when the desired data or access was obtained The targeting of specific victims is unlike previously seen behavior in regional campaigns by Gaza Cybergang or Desert Falcons and points to an elaborate information-gathering exercise that was carried out before the attacks (physical and/or digital) With deception and false flags increasingly being employed by threat actors, attribution is a hard and complicated task that requires solid evidence, especially in complex regions such as the Middle East Functionality was identified that enables HTTP communication with the C&C server and invokes “processcreate” based on parameters received as a response Data sent to the C&C server is also encrypted using 3DES and Base64 Different keys are used for local and network encryption The malware starts communicating with the C&C server by sending basic information about the infected machine Sample of the C&C response with encrypted commands and configurations Examples of attack decoys Translation: Contacts list of media personnel Translation: Relations between UAE and Jordan, and the impact caused by the non-boycott of Qatar Translation: Military retirement statement 2017 June Translation: The new Hamas structure for Gaza strip 2017 Translation: Clarification report (on Gaza employee salaries) What should high-profile organizations do? High-profile organizations should have elevated levels of cybersecurity Attacks against them are inevitable and are unlikely to ever cease These organizations need to pay particular attention to their security, implementing additional measures to ensure they are well protected Anti-targeted attack solutions, threat intelligence capabilities and data flows, default-deny application lockdown, endpoint detection and response, data leak and insider threat prevention, and even isolated/air-gapped networks should form the basis of any strategy for protecting organizations in the current threat landscape The victims of Operation Parliament need to re-evaluate their approach to cybersecurity  ### Response: .