Russian Hackers Use EFF Website to Spread Malware – Operation Pawn Storm Now Targets EFF Readers – The Electronic Frontier Foundation (EFF) has sounded the alarm, warning its users to be especially cautious about a spear phishing email campaign that is infecting its victims with the Sednit malware.
It came to the attention of the EFF with the help of security after it detected something dangerous on the electronicfrontierfoundation.org domain during one of its routine scans. The official EFF domain name is eff.org.
Spear phishing campaign leads to Sednit malware
Presenting the analysis of the attack, EFF's Cooper Quintin explains how recipients of spear phishing emails are lured to a website using the domain electronicfrontierfoundation.org, which, unfortunately, remains unregistered by the organization. Both the emails and the domain use official EFF branding.
When the user is on the hacker's domain, they are automatically redirected to a page using a random URL, where a Java applet is loaded.
Once the payload is loaded, the random URL is disabled to thwart security analysts' efforts. This payload, once on the user's computer, uses a recently discovered Java zero-day exploit to load a second payload, a binary file containing malicious code that operates in the same way as the recent Sednit malware used in the Operation Pawn Storm attacks.
Connection with the Russian government
As previously investigated by Trend Micro researchers, Operation Pawn Storm appears to be the work of a hacking group closely linked to the Russian government.
Previous victims of Operation Pawn Storm include Western financial institutions, NATO forces, the White House, the Polish government, as well as various Russian journalists, all of whom were critics of the Kremlin regime.
By targeting the EFF website, the hackers behind the recent phishing campaign hope to gather information from Russian government dissidents who regularly visit the EFF website, which is known for exposing many of the Russian government's abuses.
EFF phishing campaign analysis (3 images)
