- SMB Spotlight
A hacker group believed to have links to the notorious Syrian Electronic Army (SEA) is mounting a wave of cyber attacks using the BlackWorm remote access trojan (RAT).
FireEye threat researchers Kyle Wilhoit and Thoufique Haq reported uncovering the cyber campaign in a blog post warning the group, codenamed The Syrian Malware Team (SMT), is hitting a number of targets with a developed version of the public attack tool.
"The Syrian Electronic Army has made news for its recent attacks on major communications websites, Forbes, and an alleged attack on Centcom. While these attacks garnered public attention, the activities of another group - The Syrian Malware Team - have gone largely unnoticed," read the post.
"The group's activities prompted us to take a closer look. We discovered this group using a .NET-based RAT called BlackWorm to infiltrate their targets."
BlackWorm is a common tool originally co-authored by Naser Al Mutairi from Kuwait, better known by his online moniker "njq8". The RAT's builder is available on many cyber black markets and development forums and has been used to create a variety of different BlackWorm variants and attack tools.
The SMT primarily uses an altered version of the BlackWorm RAT, codenamed the Dark Edition (v2.1). The FireEye researchers said the Dark Edition is more dangerous than the original RAT.
"BlackWorm v2.1 has the same abilities as the original version and additional functionality, including bypassing User Account Control (UAC), disabling host firewalls and spreading over network shares," read the post.
"Unlike its predecessor, it also allows for granular control of the features available within the RAT. These additional controls allow the RAT user to enable and disable features as needed."
It is currently unknown how long the SMT's campaign has been running or who specifically is being targeted, but the FireEye researchers said the group has been operating since at least 2011.
BlackWorm is one of many attack tools to receive technical upgrades over the past year.
Researchers from Trend Micro reported finding a variant of the Bifrose malware that leverages the Tor network to hide its communications has been caught targeting an unnamed device manufacturer on 29 August.