Hezbollah likely behind malware that attacked Israeli servers
April 9, 2015 2 Comments
By JOSEPH FITSANAKIS | intelNews.org
A report by a major Israeli computer security firm claims that “a Lebanese entity”, possibly Hezbollah, was behind a cyberespionage operation that targeted companies connected to the Israeli military. In late March, Israeli computer security experts announced they had uncovered an extensive cyberespionage operation that targeted computers in Israel, and to a lesser extent in the United States, Britain, Turkey and Canada. The cyberespionage operation, dubbed VOLATILE CEDAR by Israeli computer security experts, was allegedly launched in 2012. It employed a sophisticated malicious software, also known as malware, codenamed EXPLOSIVE. One Israeli security expert, Yaniv Balmas, said the malware was not particularly sophisticated, but it was advanced enough to perform its mission undetected for over three years.
It is worth noting that, during the period of operation, the EXPLOSIVE malware kept surreptitiously updating itself with at least four different versions, which periodically supplemented the original malware code. Additionally, once the discovery of the malware was publicized in the media, security experts recorded several incoming messages sent to the installed malware asking it to self-destruct. These clues point to a level of programming and operational sophistication that exceeds those usually found in criminal cyberattacks.
According to Israeli computer security firm CheckPoint, there is little doubt that the source of the malware was in Lebanon, while a number of programming clues point to Lebanese Shiite group Hezbollah as “a major player” in the operation. In a report published this week, CheckPoint reveals that most of the Israeli targets infected with the malware belong to data-storage and communications firms that provide services to the Israel Defense Forces. According to one expert in the firm, the malware designers took great care to avoid “a frontal attack on the IDF network”, preferring instead to target private entities that are connected to the Israeli military. More specifically, the web shells used to control compromised servers after successful penetration attempts were of Iranian origin. Additionally, the initial command and control servers that handled EXPLOSIVE appear to belong to a Lebanese company.
The head of CheckPoint’s security and vulnerability research unit, Shahar Tal, told Ha’aretz newspaper: “We are not experts on international relations and do not pretend to analyze the geopolitical situation in Lebanon”. But these attacks originated from there, and were specifically designed to infiltrate “systems that are connected to the IDF”, he added.
By JOSEPH FITSANAKIS | intelNews.org







By JOSEPH FITSANAKIS | intelNews.org









ISIS has lost control of most oil fields: German intelligence report
April 10, 2015 by Joseph Fitsanakis Leave a comment
The Islamic State has lost control of approximately 95 percent of its oil production capacity following the advancing Iraqi counteroffensive, according to a leaked German intelligence report. Last June, a massive offensive by armed members of the Islamic state, also known as the Islamic State of Iraq and al-Sham (ISIS), conquered much of northern Iraq, including the cities of Mosul and Tikrit. As the crumbling Iraqi army kept hastily retreating south, ISIS forces encountered almost no resistance during their onslaught.
In the past two months, however, a large-scale counter-offensive by Iraqi forces and irregular Shiite militias, supported by Iran and the United States, has reclaimed much of the land previously occupied by ISIS. Earlier this month, Iraqi forces recaptured the strategically located city of Tikrit, in a move that is widely viewed as the greatest victory so far for the anti-ISIS forces.
Along with Tikrit, Iraqi forces have managed to recapture a number of oil fields, which provided ISIS with a lucrative source of income for much of the past year. On Thursday, German broadsheet Süddeutsche Zeitung cited a leaked intelligence report that claimed ISIS had lost control of “a minimum of three oil fields” in northern Iraq. The Munich-based newspaper said it had seen a report on the subject authored by the Bundesnachrichtendienst, or BND, Germany’s external intelligence agency. According to the report, the Iraqi counteroffensive had reclaimed all but one of the ISIS-controlled oil fields in the country.
The BND documents state that the ISIS government now only controls the Qayara oil field, located in Iraq’s southeastern Nineveh province. The oil field’s daily output capacity of around 2,000 barrels leaves ISIS with only “five percent of the extraction capacity” it had before the Iraqi counteroffensive, says the paper. Moreover, satellite images taken last March show that retreating ISIS forces set fire to two of the largest oil fields in their possession, the Ajil and Himrin facilities. That, according to the BND, shows that ISIS were themselves pessimistic about being able to reclaim these oil fields from the Iraqi forces.
Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with Ajil oil field (Iraq), BND, energy resources, Himrin oil field (Iraq), Iraq, Islamic State, Islamic State of Iraq and al-Sham, Islamic State of Iraq and Greater Syria, News, Qayara oil field (Iraq)