Operation Woolen Goldfish, a hacking campaign in the wild

Security experts at Trend Micro have uncovered a new cyber espionage campaign that is targeting a number of European organisations and businesses. The attackers run a spear phishing campaign that was dubbed by the experts Operation Woolen Goldfish.

“The first of these campaigns has already been exposed at 31C3 by Tillman Werner and Gadi Evron. That campaign started with traditional spear phishing e-mails that use basic social engineering techniques to entice the targeted users to open a Microsoft Office file.” states the report published by Trend Micro.

Trend Micro researchers speculate that the threat actors behind the Operation Woolen Goldfish are linked with another espionage campaign dubbed the “Rocket Kitten” that was spotted in December 2014.

“Rocket Kitten refers to a cyber threat group that has been hitting different public and private Israeli/European organizations. It has launched two campaigns so far: a malware campaign that exclusively makes use of GHOLE malware, as well as a targeted attack dubbed as “Operation Woolen-GoldFish” that’s possibly state-sponsored.” states Trend Micro.

Rocket Kitten campaign presented a number of similarities with this last wave of cyber attacks, also in that case the attack chain started with a spear phishing campaign, the messages were crafted to lure victims into open malicious Office files loaded with a “Ghole” malware.

The attacks reported to the experts at Trend Micro were characterized by indicators of a specific malware family.

“The alert showed an infected Microsoft Excel file that soon proved to have been launched by Rocket Kitten.”

Respect The Rotten Kitten, the Woolen Goldfish campaign appears far more sophisticated.

“By the end of 2014 we saw significant changes in the attack behavior of the Rocket Kitten group in terms of spear-phishing campaigns and malware infection schemes,” states the paper.

Both campaigns exploit the GHOLE malware, but in the Operation Woolen Goldfish the spear-phishing messages embedded with a malicious link that leads to a malicious file stored on OneDrive cloud storage.

GHOLE isn’t the unique variant of malware used by attackers, recently the experts discovered samples of a keylogger known as the CWoolger keylogger.

“The attackers used a OneDrive link in their campaign. OneDrive is a free online cloud storage system from Microsoft that comes with several gigabytes of data storage capacity,” explained the report.

“Once executed, the file drops a non-malicious PowerPoint file used as a decoy file, while silently infecting the system with a variant of the CWoolger keylogger.”

Researchers at Trend Micro discovered that the CWoolger keylogger was developed by a hacking crew named “Wool3n.H4t”, which is believed to have been involved in the Rocket Kitten attacks.

“Consistent with the other malware used by the threat actors involved in Operation Woolen Goldfish, the command and control reference is hard-coded as an IP address in the binary,” reports the paper.

“A domain name was not used. Moreover, it lands on the system with a name, which is very similar to some Ghole malware variants [used by Rocket Kitten].”

Experts speculate that the attackers are still operating and it is likely that they are running a new campaign using new hacking tools.

“From our findings we can definitely say that threat actor team is alive and active,” state the experts.” With all the evidence, Rocket Kitten’s attacks can be construed as politically-motivated, as the targeted entities do share a particular interest in the Islamic Republic of Iran. While motives behind targeted attack campaigns differ, the end results are one and the same: shift in power control either in the economically or politically.”

Pierluigi Paganini