Search KuwaitPR.com

Home >> Technology

Cyberattacks on Kuwait Shipping and Transportation Organizations

Tuesday, September 24, 2019/ Editor -  

Share

Home >> Technology

September 24, 2019 - Kuwait

Between May and June 2019, Unit 42, the global threat intelligence team at Palo Alto Networks, observed previously unknown tools used in the targeting of transportation and shipping organizations based in Kuwait.

The first known attack in this campaign targeted a Kuwait transportation and shipping company in which the actors installed a backdoor tool named Hisoka. Several custom tools were later downloaded to the system in order to carry out post-exploitation activities. All of these tools appear to have been created by the same developer. We were able to collect several variations of these tools including one dating back to July 2018. 

The developer of the collected tools used character names from the anime series Hunter x Hunter, which is the basis for the campaign name “xHunt.” The names of the tools collected include backdoor tools Sakabota, Hisoka, Netero and Killua. These tools not only use HTTP for their command and control (C2) channels, but certain variants of these tools use DNS tunneling or emails to communicate with their C2 as well. While DNS tunneling as a C2 channel is fairly common, the specific method in which this group used email to facilitate C2 communications has not been observed by Unit 42 in quite some time. This method uses Exchange Web Services (EWS) and stolen credentials to create email “drafts” to communicate between the actor and the tool. In addition to the aforementioned backdoor tools, we also observed tools referred to as Gon and EYE, which provide the backdoor access and the ability to carry out post-exploitation activities.

Through comparative analysis, we identified related activity also targeting Kuwait between July and December 2018, which was recently reported by IBM X-Force IRIS. While there are no direct infrastructure overlaps between the two campaigns, historical analysis shows that the 2018 and 2019 activities are likely related.


Previous in Technology

Next in Technology


Home >> Technology Section

Latest Press Release

Urgent Implementation of ICAO COVID-19 Guidelines Needed

The New HUAWEI P40 Pro: Here are its Seven Cool fFatures You Need to Know About

Omega Announces Its Role as the Official Timekeeper of the 36th America's Cup

HONOR MagicBook Series is Perfect for Fashion Forward, Design Conscious Individu ...

The New Edition of HUAWEI WATCH GT 2e is here with a Two Weeks Battery and Other ...

Eid Gifts From The Body Shop

Made in Italy, ICSA® Issues a Notification of Counterfeit Products Found in the ...

UAE Banks Among Top Performing in GCC, KPMG Report Finds

Kristina Fidelskaya A/W 2020 Collection “Dream”

Maillon De Cartier Watch

Make Up for Ever Introduces for the First Time Its New Active Care-in-foundation ...

5 Tricks Your HUAWEI Nova 7i Can Do to Entertain You at Home

Olay Eyes Hydra Gel

Ralph Lauren Expands Its Earth Polo Offering, Reinforces Commitment to Protectin ...

LG Prioritizes Home Comfort With Latest Air Conditioners for GCC Market

COVID-19 Triggers Marked Decline in Global Trade: UNCTAD

Kuwait COVID-19 Business Impact Survey Finds 45% of Businesses Have Shut Down Si ...

7 Cool Tricks on How to Make the Best Use of Your New HUAWEI Nova 7i

HUAWEI's AppGallery: Designed to Enhance User Experience

HUAWEI Watch GT 2e - your perfect health companion while staying at home