Israel’s Candiru Spyware Found Linked to Watering Hole Attacks in U.K and Middle East

Israeli spyware vendor Candiru, which was added^[1]
to an economic blocklist by the U.S. government this month, is said
to have reportedly waged “watering hole” attacks against
high-profile entities in the U.K. and the Middle East, new findings
reveal.

“The victimized websites belong to media outlets in the U.K.,
Yemen, and Saudi Arabia, as well as to Hezbollah; to government
institutions in Iran (Ministry of Foreign Affairs), Syria
(including the Ministry of Electricity), and Yemen (including the
Ministries of Interior and Finance); to internet service providers
in Yemen and Syria; and to aerospace/military technology companies
in Italy and South Africa,” ESET said^[2]
in a new report. “The attackers also created a website mimicking a
medical trade fair in Germany.”

The strategic web compromises are believed to have occurred in
two waves, the first commencing as early as March 2020 before
ending in August 2020, and the second string of attacks beginning
in January 2021 and lasting until early August 2021, when the
targeted websites were stripped clean off the malicious
scripts.

Watering hole attacks are a form of highly targeted intrusions
in that they tend to infect a specific group of end-users by
backdooring websites that members of the group are known to
frequent with the goal of opening a gateway into their machines for
follow-on exploitation activities.

“The compromised websites are only used as a jumping-off point
to reach the final targets,” the Slovak cybersecurity firm said,
linking the second wave to a threat actor tracked by Kaspersky as
Karkadann^[3]
citing overlaps in the tactics, techniques, and procedures (TTPs).
The Russian company described the group as targeting government
bodies and news outlets in the Middle East since at least October
2020.

The original attack chains involved injecting JavaScript code
into the websites from a remote attacker-controlled domain that’s
designed to collect and exfiltrated I.P. geolocation and system
information about the victim machine, opting to proceed further
only if the operating system in question is either Windows or
macOS, suggesting the campaign was orchestrated to target computers
and not mobile devices. The final step led to a likely browser
remote code execution exploit that enabled the attackers to hijack
control of the machines.

The second wave observed in January 2021 was characterized by
more stealth, as the JavaScript modifications were made to
legitimate WordPress scripts (“wp-embed.min.js^[4]“) used by the websites
instead of adding the malicious code straight to the main HTML
page, using the method to load a script from a server under the
attacker’s control. What’s more, the fingerprinting script also
went beyond harvesting system metadata to capture the default
language, the list of fonts supported by the browser, the time
zone, and the list of browser plugins.

The exact exploit and the final payload delivered remain unknown
as yet. “This shows that the operators choose to narrow the focus
of their operations and that they don’t want to burn their zero-day
exploits,” ESET malware researcher Matthieu Faou said.

The campaign’s links to Candiru stems from the fact that some of
the command-and-control servers utilized by the attackers are
similar to domains previously identified as belonging to the
Israeli company, not to mention feature browser-based remote code
execution exploits in its arsenal, raising the possibility that
“the operators of the watering holes are customers of Candiru.”

ESET noted that the attackers ceased operations at the end of
July 2021, coinciding with the public disclosures^[5]
about Candiru related to the use of multiple zero-day vulnerabilities^[6] in the Chrome browser to
target victims located in Armenia. “It seems that the operators are
taking a pause, probably in order to retool and make their campaign
stealthier,” Faou said. “We expect to see them back in the ensuing
months.”