A spear-phishing campaign some researchers say is linked to the Russian government masqueraded as the Electronic Frontier Foundation in an attempt to infect targets with malware that collects passwords and other sensitive data.
The targeted e-mails, which link to the fraudulent domain electronicfrontierfoundation.org, appear to be part of a larger campaign known as Pawn Storm. Last October, researchers at security firm Trend Micro brought the campaign to light and said it was targeting a US military, embassy, and defense contractor personnel, dissidents of the Russian government, and international media organizations. Last month, Trend Micro said the espionage malware campaign entered a new phase by exploiting what then was a zero-day vulnerability in Oracle's widely used Java browser plugin. Separate security firm FireEye has said the group behind the attacks has ties to Russia's government and has been active since at least 2007.
EFF staff technologist Cooper Quintin wrote in a blog post published Thursday that the round of attacks involving the electronicfrontierfoundatioin.org site may have the ability to infect Macs and Linux machines, as well as the normal Windows fare. On Windows, the campaign downloads a payload known as Sednit that ultimately installs a keylogger and other malicious modules. Its use of the same path names, Java payloads, and Java exploits found in last month's campaign mean it's almost certainly the work of the same Pawn Storm actors that struck last month. Quintin wrote:
The attack is relatively sophisticated—it uses a recently discovered Java exploit, the first known Java zero-day in two years. The attacker sends the target a spear phishing email containing a link to a unique URL on the malicious domain (in this case electronicfrontierfoundation.org). When visited, the URL will redirect the user to another unique URL in the form of
http://electronicfrontierfoundation.org/url/{6_random_digits}/Go.classcontaining a Java applet which exploits a vulnerable version of Java. Once the URL is used and the Java payload is received, the URL is disabled and will no longer deliver malware (presumably to make life harder for malware analysts). The attacker, now able to run any code on the user's machine due to the Java exploit, downloads a second payload, which is a binary program to be executed on the target's computer.
Quintin said he suspects electronicfrountierfoundatioin.org has been serving malware since August 4, when the domain address was registered. The site had been reported for abuse, but as of Thursday it was still actively exploiting the Java vulnerability. On Friday morning, it was redirecting users to the authentic EFF page.
The attack is a potent reminder of the importance of installing security updates promptly. Oracle patched the critical Java vulnerability a few days after Trend Micro reported the July zero-day attacks. Then again, Ars has long advised people to assess if they truly required Java and other browser plugins and if not to consider uninstalling them.