Contributor: Andrea Lelli
Operation Francophoned, first uncovered by Symantec in May 2013, involved organizations receiving direct phone calls and spear phishing emails impersonating a known telecommunication provider in France, all in an effort to install malware and steal information and ultimately money from targets.
This highly targeted dual-pronged attack has proven to be very persistent in the French speaking world. Keeping a close eye on the Francophoned campaign, Symantec observed a resurgence in October 2013 and, early this year, witnessed some changes to the social engineering attack including the use of new malware.
Figure 1. How Operation Francophoned works
According to our telemetry (Figure 2), the Francophoned operation reemerged in October 2013 with a new campaign of spear phishing emails, immediately followed by a lull in activity that could be due to the attackers using this time to process the data acquired from successful attacks and preparing for the next campaign. A few months later, two new campaigns were observed, with a much shorter processing/preparation period in-between. Both of these campaigns used a completely new threat.
Figure 2. Francophoned attacks detected overtime
October 2013 – January 2014: The resurgence of Operation Francophoned
The attackers did not change much during this time period, the social engineering tactics and malware used in the initial campaign (W32.Shadesrat aka Blackshade) remained the same. Victims received spear phishing emails, which impersonated a well-known company, and were lured into downloading fake invoices hosted on a new compromised domain. In some instances, the attackers were more aggressive and called the victims in order to enforce the spear phishing emails over the phone.
February 2014 – Present: Operation Francophoned changes
In February of this year, the campaign took a new turn. The attackers began distributing a new payload from a number of freshly compromised domains, resulting in a sudden increase in infection numbers. However, the payload was different from that used previously (Blackshade), though the attackers still used the same command-and-control (C&C) server. The move to a different payload shows that those behind these attacks are eager to evolve their business and innovate new ways of making money. The new threat used by the attackers, named Trojan.Rokamal, is obfuscated with a DotNet packer and can be configured to perform the following actions:
- Downloading and executing potentially malicious files
- Performing distributed denial-of-service (DDoS) attacks
- Stealing information
- Mining cryptocurrency
- Opening a back door
The cryptocurrency mining and DDoS functions were not enabled in the Trojan.Rokamal samples used in the operation. As Operation Francophoned is aimed at organizations, disabling these functions makes sense because they would raise several flags and be easily spotted if active in a business environment.
The organizations targeted by Operation Francophoned fall into the sectors shown in Figure 3.
Figure 3. Sectors targeted by Operation Francophoned
Despite an increase of activity this year with the use of Trojan.Rokamal, Operation Francophoned still focuses only on French organizations and speakers based in and outside of France. The following heatmap shows the concentration of the Francophoned attacks around the world.
Figure 4. Operation Francophoned detections worldwide
Language and cybercrime
Operation Francophoned was specifically crafted to target French speakers and proves that language is a major (and often underestimated) factor in the reach and effectiveness of cybercrime campaigns. For example, in terms of countries it is spoken in, French is the second most widely spoken language. It is an official language in 29 countries, spoken by 110 million native speakers, and by another 190 million as a second language. French speakers are concentrated not just in France, but also in wide areas of Africa, nearby European countries, Canada, and various islands around the world. As such, French speakers present a large pool of potential victims who may not have been targeted as heavily as English speakers.
Protection
Symantec advises users to be careful when dealing with suspicious emails and to avoid clicking on suspicious links or opening suspicious attachments. Symantec also recommends verifying a person’s identity when receiving a business related call.
Symantec has the following antivirus, reputation, and heuristic detections in place to protect against this threat: