Check Point Unveiled Identity of Iranian-Linked Cyber Espionage Attackers

10 November, 2015

Based on the nature of the attacks and associated repercussions, the report suggests Rocket Kitten’s motives were aligned with Iranian nation-state intelligence

Based on the nature of the attacks and associated repercussions, the report suggests Rocket Kitten’s motives were aligned with Iranian nation-state intelligence

CYBER

Check Point Software Technologies from Israel, published a 38-page report identifying specific details and broad analysis on cyber-espionage activity conducted by the group ‘Rocket Kitten,’ with possible ties to Iranian Revolutionary Guard Corps. The report also reveals details of the group’s global operations and unique insight into more than 1,600 of their targets.

Led by researchers in Check Point’s Threat Intelligence and Research Area, the never-before-published data paints a picture of strategic malware attacks supported by persistent spear phishing campaigns. The details show Rocket Kitten actively targeted individuals and organizations in the Middle East, as well as across Europe and in the United States.

The report trace and unmask the true identity of an aliased attacker, identified as “Wool3n.H4T,” as one of the prominent figures behind this campaign. Further, based on the nature of the attacks and associated repercussions, the report suggests Rocket Kitten’s motives were aligned with nation-state intelligence interests, aimed at extracting sensitive information from their targets.

Rocket Kitten is still active

The report mentions that since early 2014, an attacker group of Iranian origin has been actively targeting persons of interest by means of malware infection, supported by persistent spear phishing
campaigns. This cyber-espionage group was dubbed ‘Rocket Kitten,’ and is still active.

Characterized by relatively unsophisticated technical merit and extensive use of spear phishing, the group targeted individuals and organizations in the Middle East (including targets inside Iran itself), as well as across Europe and in the United States.

Live map of global cyber attacs on Check Point's website — Live map of global cyber attacs on Check Point’s website

The Rocket Kitten attacker group’s main attack vector is spear-phishing. An effective phishing campaign requires nothing more than a tailored phishing page, hosted on a cheaply-available web server. The Rocket Kitten attackers make extensive use of various phishing schemes, often including back-and-forth e-mail correspondence with the victims, or even phone calls to establish legitimacy and reason to open the malicious attachment.

Many of these targets were successfully compromised by various pieces of custom-written malware; and despite identification and flagging of their infrastructure, the attackers have struck again-and-again by making minor changes to their tools or phishing domains.

Check Point has obtained a complete target listing from the attackers’ servers; among confirmed victims are high ranking defense officials, embassies of various target countries, notable Iran researchers, human rights activists, media and journalists, academic institutions and various scholars, including scientists in the fields of physics and nuclear sciences.

This database revealed that phishing pages had 26% success in fooling victims to enter their credentials. These are surprisingly high results, potentially attributed to persistency and well-targeted e-mails.“This research provides a rare look at the nature and global targets of a global cyber espionage group,” said Shahar Tal, Research Group Manager, Check Point.

To the full report: Rocket Kitten: A Campaign with 9 Lives

Posted in: Business , Cyber , Featured Stories , News , Software and IT