Operation Silent Watch [CPRadio]

Produced by PI Media July seventh, twenty twenty one. According to secure hosting provider quarium Quote, several prominent human rights and political activists in Azerbaijan end quote all received the same email, perpetrating to come from the NGEO Human Rights Watch. The sender was maybe a little on the nose human rights do invoicer at gmail dot com. The body of the mail began quote, we present a

new project for Azerbaijani political and human right activists end quote. The message prompted targets to download an invoiced document, which, upon being extracted, presented an error message unsupported Microsoft word version file corrupted with an error number. If it weren't already obvious that this was an attack, the multiple misspelled words like unsupported

with two ohs and number without B might have given it away. Any victim that reached this point had, perhaps unbeknownst to them, downloaded malware to their computer, Malware with the ability to remotely execute commands, steal or upload files, and record their screens or webcam feeds. Perhaps because the fishing was so simplistic enough activists cut on before they got to that point. But this campaign was merely a harbinger of worse things to come. High listeners, I'm rand

Levy. Welcome to a somewhat unique episode of CP Radio to give people some sense of the gravity of this situation of why is it that we are distorting our voice for this episode. So we're going to discuss sensitive topics that potentially involve nation state actors. So we want to protect the identity of all the researchers that are involved in this. We've covered nation state attacks plenty of times

on this podcast. Perhaps some precaution is warranted in this case. However, because of how commonly the individuals who speak out on this conflict find themselves targeted for it. We're talking about a highly charged environment. So the political context of the story we're going to talk today about is based on the conflict,

which is not a very known outside the region. It at all involves Azerbaijan and Armenia, the two countries in South Caucuses between the Caspian and Black Sees, just east of Turkey and north of Iran, both our former Soviet Union republics. They gained independence after the dissolution of the Soviet Union, and the conflict is around the Republic of Arts are also known as Nagorno Karaba. It's a breakaway region in the South Caucasus, with a majority of population being Armenians,

but internationally it's recognized as a part of Azerbaijan. A land area which, despite being mostly Armenian, is almost entirely encapsulated by Isaiahbaijan, so it's de facto is an enclave with Azerbaijan, and the only route from Armenia to Nagona Karba is through Latching Corridor, which is currently under the Peacemaker's Russian Peacemakers control. This tiny little livery of land is a primary locus of the years

long conflict. The situation in Arta is pretty tense. There are a lot of military conflicts there in the area and all kinds of cease fire relations and sporadic violence. And this is the conflict of that largely affects the relationship between the two countries for more than twenty years. Tensions flared late last year when Azerbaijani citizens working for the Azerbaijani government blocked off the Little Lashing Corridor, thereby

disconnecting Artac from Armenia and the rest of the world. Azerbaijanian side claims it is peaceful, Echo protests. Armenian side claims there is the blockade by Azerbaijanians in order to cut the region from the supplies. The stage protest at Lashing was very significant, but it wasn't the only action taken by the Azerbaijani government at the time. In late November, one of the major banks in the region got a malicious email, art Zach Bank, an Armenian bank with eleven

branches in the disputed region. A suspicious email delivered to art Zach Bank included a pf document for the Wikipedia page of a man named Alexander Lapshin. Alexander Lapshin is Russian Israeli blogger. His pro Armenian in a relation to the Armenians

Reiginia conflict and he talks openly about that. So in twenty sixteen he was detained in Belarus and was extradited to Azerbaijan by the request from Azerbaijanian government, and there he was accused of visiting the territory of Azerbaijan, which is Arza back in twenty eleven twenty twelve without getting the permission from Azerbaijani authorities. Lapshin was sentenced to three years in an Azerbaijani prison, and a few months after

his detention as Erbijan, something happened. Azerbijinian side claims that it was a suicide attempt. Lapshin himself claims that it was an attempt to kill him. So he was hospitalized and then a few days later he was pardoned by the President of Zerbijan and sent back to Israel. Then he started a court case

against Azerbaijan in the European Court of Human Rights. On May twenty, twenty twenty one, in the case of Lapshin versus Azebeijan, the court ruled that Azerbaijani authorities violated Laphin's right to life and ordered them to pay him thirty thousand

euros. To celebrate his victory, Laptin had a bit of fun. So the next day after this decision, what he did is on his Facebook account he published a picture of a credit card for the bank account that he opened specifically to get this money from the Azerbaijanian government, and he kind of mocked the Azerbaijinian government by opening this account in Artabank. Azerbaijan didn't take kindly to

being trolled. This was the context for a suspect PDF delivered to ARTSA Bank just a couple of weeks before the blocade of the art SAC which so it's kind of pretty much nice way to lure the employees of the banquet to open something that came with his name and use it. The idea was that while the employee was only seeing debate quietly in the background of their computer, a

malicious backdoor was borrowing into the network. In August twenty twenty one, a month after a phishing campaign was deployed against az a Baijanny activists, computer in Armenia uploaded a mailware sample to virus Total website for detecting mailware in files and u r els. The file was aptly named Report on the Azebaijanny Military Aggression Final Update twenty twenty one do SCR. Despite being a screen saver file,

it was presented on screen with a PDF icon. Upon execution, the file presented victims with a document titled quote report on the Bay Johnny Aggression against Arzac, Nagono, Kabach and Armenia end quote. Evidently, in the months that passed between attacks, the hackers didn't improve their spelling forgetting a G in aggression,

but they clearly had improved in other ways. The lure was more specific, more enticing to the particular kind of target they were after compared with the more general Human Rights Watch invoice, and the malware too was being iterated on. The first version of this malware was used around July twenty twenty one, and it was much more simpler. It had much less commands. It's basically

knew just how to collect the recordings and run additional commands. Then we've seen it once again in February twenty twenty two, with much more advanced features like collecting the files in different ways February twenty twenty two. This time the email pretended to come from the BBC and required a password for decryption, a clever little adjustment since anti virus programs without knowing the password to a file can't actually

read and interpret whether they're safe or not. The attackers were working on their tactics, techniques, and procedures for over a year, probably two years, and we lead up to late twenty twenty two, when, for at least the fourth time, and for the very first time against a commercial organization they deployed their mailware. So we call the smaller oxter rat oxta rat as in remote excess Trojan. Oxter Rat is based on out to it a perfectly legitimate

computer language for automating the Windows user interface. It's a legitimate administrative tool in order to allow the ite administrators to perform their tasks, but it's often abused by all kinds of malicious activities. A decade ago, trend micro analyzed why so many hackers were choosing out to it. As one expert explained, quote out too, it is scalable, very similar to basic, and is outrageously easy to code. In will Hood said, this ease of use takes the

learning curve of learning more complex languages such as Python. This opens up a wide array of possibilities to hackers that may not otherwise expose themselves to a scripting language. In other words, out to it can make your job easy if you're in a rush, maybe, or if you're not particularly good hacker, like perhaps the folks behind oxterat, I would say that technically it's not very

complicated, but it works. Although it's not some fancy, super stealthy thing, it does a job however simplistic it might be, oxter Ret is nonetheless dangerous years in the making, with many different types of components, which allows to run additional code on the machine, search and exfiltrate for different types of files and data on the machine, to perform active surveillance activity by a recording video from a desktop from web camera, by performing screenshots, also installing additional

software for remote access control such as TITVNC, basically anything an attacker could imagine wanting to do a victim computer and also to collect all different kinds of information about the machine itself, the processes, the drives, the system information, and also it allows to perform port scunning and use this compromised machine in order to pivot inside the network. By the time of their late twenty twenty two attack, the hackers had also improved on their tactics for hiding Oxterret. First

among them was out to it itself. Hackers like to use commercial software to trick computers into thinking that their behavior is legitimate. These hackers used outoit to compile malicious code and run it as seemingly legitimate automation on a Windows computer. Scireding anti virus engines along the way, and also the actors improved their sec They gat offense their servers, meaning only those who come from the specific IP ranges. In our case, the payloads were received only from IP addresses in

Azerbajan and Erminia. Only those can get the actual payload and be infected. This is done in order for researchers not to find it easily and find it and revealed culpabilities easily. And lastly, in their efforts to evade detection, they did a small trick, perhaps their most clever tactic. They hide the code in the image, like regular PN image which is run by dogs encoding malware into an image file. These types of files are called polyglot files,

meaning they might be legitimate picture and something else. So in this case, if you open this as a picture, let's say, with your picture editor, then you will see it as a picture. But if you run it with the two that's supposed to run it as a script, then it will run as a script. What's the purpose of all this. It's probably done in order to hide the artifacts on the machine from those who are going to investigate it later, because you will just see in the file system an image

and you won't even think that it's somewhere inside of it. There is a script hidden, and it's hidden in compiled forms, so even if you open it in text editor of then you will just see a lot of gibberish that does make any sense. Oxter Rat has many components to it, many mechanisms to prevent detection and functions to carry out malicious deeds, but at the end of the day, its focus is clear. The main intention of the smaller

is just to sit patient and collect all different kinds of the information. Multiple functions in this backdoor are actually related to collecting the data in the most effective way possible, search for the data on the machine with the many different kinds of tools, then compress it and send it to the attack or control server.

So if we talk about using this malware incorporate environments, then it might lead to potential compromise of the customers personal data, and then it can be used in order to facilitate any other different kind of attack starting from social engineering to all kind of more advanced operations, or just lick their data to some other third parties. Ultimately, this attack probably wasn't about gathering bank account numbers

or rout consumer data. The hackers were clearly politically motivated and likely wanted to attack certain specific people. When we talk about the individuals, the effects of surveillance on them is much more serious. First, we've seen the cases when the usage of this malware eventually brought to the destruction of the work of people who were targeted by that. For example, when actors gain access to the journalists media social media accounts, then they just deleted all their posts or basically

just through into part of their work. Another thing is that surveillance operations usually not only involve the target itself themselves, but also all the people around them. So if you read the stories about for example, Pegasus, the Israeli NSO group developed spyware used against activists, politicians, and others around the globe, you will hear the victims being a shock that they found out that not only them were being targeted, but also their relatives or their partners, and

it's a little bit scary. Fortunately, at the end of our story, the employees of ARTSA Bank escaped compromise. But as our guest and her colleagues noted in a blog post quote, due to the infrastructure revealed, we believe that there might have been other targets of this campaign in Armenia as well. Exactly who else was targeted and whether they fell into the attackers trap remains unknown, and based on the evidence of recent years, we can only expect that

these adversaries will be back again soon. Our goal as the security community is to make this world a little bit better, So I think it's important to raise awareness of the text like this because they affect individuals and their relatives, and we really hope that this research will inspire also other vendors to talk more about this region, about this conflict and what's going on there. That's it

for this episode. Thank you for listening. For past episodes, visit Checkpoints Research blog at research dot checkpoint dot com, and you can follow Checkpoint Research on Twitter or follow me at Ryan Levy. That's r A n l e v I. CEP Radio is produced by PI Media, written by Nick Neilson, produced by Hila Shemish, and edited and narrated by me Ran Levy. See you next episode. Bye bye,