Fake EFF site serving espionage malware was likely active for 3+ weeks

[InfoSec News <alerts () infosecnews org>]

http://arstechnica.com/security/2015/08/fake-eff-site-serving-espionage-malware-was-likely-active-for-3-weeks/

By Dan Goodin
Ars Technica
Aug 28, 2015

A spear-phishing campaign some researchers say is linked to the Russian 
government masqueraded as the Electronic Frontier Foundation in an attempt 
to infect targets with malware that collects passwords and other sensitive 
data.

The targeted e-mails, which link to the fraudulent domain 
electronicfrontierfoundation.org, appear to be part of a larger campaign 
known as Pawn Storm. Last October, researchers at security firm Trend 
Micro brought the campaign to light and said it was targeting US military, 
embassy, and defense contractor personnel, dissidents of the Russian 
government, and international media organizations. Last month, Trend Micro 
said the espionage malware campaign entered a new phase by exploiting what 
then was a zero-day vulnerability in Oracle's widely used Java browser 
plugin. Separate security firm FireEye has said the group behind the 
attacks has ties to Russia's government and has been active since at least 
2007.

EFF staff technologist Cooper Quintin wrote in a blog post published 
Thursday that the round of attacks involving the 
electronicfrontierfoundation.org site may have the ability to infect Mac 
and Linux machines, as well as the normal Windows fare. On Windows, the 
campaign downloads a payload known as Sednit that ultimately installs a 
keylogger and other malicious modules. Its use of the same path names, 
Java payloads, and Java exploits found in last month's campaign mean it's 
almost certainly the work of the same Pawn Storm actors that struck last 
month. Quintin wrote:

[...]



--
Evident.io - Continuous Cloud Security for AWS.
Identify and mitigate risks in 5 minutes or less.
Sign up for a free trial @ https://evident.io/