Molerats Hackers Hiding New Espionage Attacks Behind Public Cloud Infrastructure

An active espionage campaign has been attributed to the threat
actor known as Molerats that abuses legitimate cloud services like
Google Drive and Dropbox to host malware payloads and for
command-and-control and the exfiltration of data from targets
across the Middle East.

The cyber offensive is believed to have been underway since at
least July 2021, according^[1]
to cloud-based information security company Zscaler, continuing
previous efforts^[2]
by the hacking group to conduct reconnaissance on the target hosts
and plunder sensitive information.

Molerats^[3], also tracked as TA402,
Gaza Hackers Team, and Extreme Jackal, is an advanced persistent
threat (APT) group that’s largely focused on entities operating in
the Middle East. Attack activity associated with the actor has
leveraged geopolitical and military themes to entice users to open
Microsoft Office attachments and click on malicious links.

The latest campaign detailed by Zscaler is no different in that
it makes use of decoy themes related to ongoing conflicts between
Israel and Palestine to deliver a .NET backdoor on infected systems
that, in turn, abuses the Dropbox API to establish communications
with an adversary-controlled server and transmit data.

The implant, which uses specific command codes to commandeer the
compromised machine, supports capabilities to take snapshots, list
and upload files in relevant directories, and run arbitrary
commands. Investigating the attack infrastructure, the researchers
said they found at least five Dropbox accounts used for this
purpose.

“The targets in this campaign were chosen specifically by the
threat actor and they included critical members of banking sector
in Palestine, people related to Palestinian political parties, as
well as human rights activists and journalists in Turkey,” Zscaler
ThreatLabz researchers Sahil Antil and Sudeep Singh said.