http://arstechnica.com/security/2015/08/fake-eff-site-serving-espionage-malware-was-likely-active-for-3-weeks/
By Dan Goodin
Ars Technica
Aug 28, 2015
A spear-phishing campaign some researchers say is linked to the Russian
government masqueraded as the Electronic Frontier Foundation in an attempt
to infect targets with malware that collects passwords and other sensitive
data.
The targeted e-mails, which link to the fraudulent domain
electronicfrontierfoundation.org, appear to be part of a larger campaign
known as Pawn Storm. Last October, researchers at security firm Trend
Micro brought the campaign to light and said it was targeting US military,
embassy, and defense contractor personnel, dissidents of the Russian
government, and international media organizations. Last month, Trend Micro
said the espionage malware campaign entered a new phase by exploiting what
then was a zero-day vulnerability in Oracle's widely used Java browser
plugin. Separate security firm FireEye has said the group behind the
attacks has ties to Russia's government and has been active since at least
2007.
EFF staff technologist Cooper Quintin wrote in a blog post published
Thursday that the round of attacks involving the
electronicfrontierfoundation.org site may have the ability to infect Mac
and Linux machines, as well as the normal Windows fare. On Windows, the
campaign downloads a payload known as Sednit that ultimately installs a
keylogger and other malicious modules. Its use of the same path names,
Java payloads, and Java exploits found in last month's campaign mean it's
almost certainly the work of the same Pawn Storm actors that struck last
month. Quintin wrote:
[...]
--
Evident.io - Continuous Cloud Security for AWS.
Identify and mitigate risks in 5 minutes or less.
Sign up for a free trial @ https://evident.io/
