Security News > 2021 > November > WIRTE Hacker Group Targets Government, Law, Financial Entities in Middle East

Government, diplomatic entities, military organizations, law firms, and financial institutions primarily located in the Middle East have been targeted as part of a stealthy malware campaign as early as 2019 by making use of malicious Microsoft Excel and Word documents.

Russian cybersecurity company Kaspersky attributed the attacks with high confidence to a threat actor named WIRTE, adding the intrusions involved "MS Excel droppers that use hidden spreadsheets and VBA macros to drop their first stage implant," which is a Visual Basic Script with functionality to amass system information and execute arbitrary code sent by the attackers on the infected machine.

An analysis of the campaign as well as the toolset and methods employed by the adversary has also led the researchers to conclude with low confidence that the WIRTE group has connections to another politically motivated collective called the Gaza Cybergang.

The Excel droppers, for their part, are programmed to execute malicious macros to download and install a next-stage implant named Ferocious on recipients' devices, while the Word document droppers make use of VBA macros to download the same malware.

Composed of VBS and PowerShell scripts, the Ferocious dropper leverages a living-off-the-land technique called COM hijacking to achieve persistence and triggers the execution of a PowerShell script dubbed LitePower.

"Using interpreted language malware such as VBS and PowerShell scripts, unlike the other Gaza Cybergang subgroups, adds flexibility to update their toolset and avoid static detection controls."

News URL

https://thehackernews.com/2021/11/wirte-hacker-group-targets-government.html