Nearly two thirds of the government officials, lobbyists and other victims of the cyber espionage campaign dubbed Madi were based in "Israel", security experts have discovered.
An investigation by the security firm Symantec, published on Wednesday, showed 62% of the approximately 800 victims of the snooping were based in "Israel".
It is not yet known whether the sustained attack was state-sponsored, but the focus on "Israel" will heighten concerns over the security of highly classified government projects in the Middle East.
The researchers also said a foreign consulate, various government agencies and a US-based thinktank were among those targeted by the eight-month spying campaign, which was revealed for the first time on Tuesday.
The cyber espionage, which has been termed Madi by researchers, began in December 2011 and was co-ordinated by a group of Farsi-speaking hackers, according to the security firms Kaspersky Lab and Seculert.
Experts have not found any evidence the attack is state-sponsored and little is known about the perpetrators.
On Wednesday those behind the attack were described by researchers as having "a broad agenda" of targeting critical infrastructure in the Middle East.
The attackers' servers are said to be based in Canada in January this year. Symantec said on Wednesday that its researchers had detected a further "command and control" center in Azerbaijan. It is not know whether the Madi cyber snooping is ongoing.
The attack works by sending a virus-infected email to its selected targets, who usually work for oil, gas and other critical infrastructure firms in "Israel" and neighboring countries.
Once the victims have downloaded an innocent-looking attachment from the emails, their computer becomes infected with spying software which can record audio, log keystrokes and take screen shots before sending that information back to the attackers. Researchers estimate that hundreds of gigabytes of data, equating to thousands of documents or dozens of software applications, has been secretly stolen by the Madi attackers.
"Targets of the Madi campaign appear to be all over the spectrum but include oil companies, US-based thinktanks, a foreign consulate, as well as various governmental agencies, including some in the energy sector," the research firm Symantec said in a blogpost.
It added: "Targets like Iran, "Israel", and Saudi Arabia might suggest involvement of a nation state, however our research has not found evidence that this is the case. Instead, the current research indicates these attacks are being conducted by an unknown Farsi-speaking hacker with a broad agenda."
Source: Agencies
Kavkaz Center
Our button
print version
