Pawn Storm Cybercriminal Gang Strikes Organizations Investigating MH17 Crash

Organizations involved in probing the ill-fated crash of Malaysia Airlines Flight MH17 have been assaulted by a Russian based cyber-espionage group commonly referred to as Pawn Storm, said security firm Trend Micro recently, reported securityweek.com on October 22, 2015.

Notably, Flight MH17, en-route from Amsterdam to Kuala Lumpur, was downed on July 17, 2014, after it was reportedly attacked by a Russian-manufactured missile while moving across a conflict-ridden area in eastern Ukraine. The probe of the case was piloted by the DSB (Dutch Safety Board) that published a paper on the incident on October 13, 2015.

As per Trend Micro, the Pawn Storm cyber-espionage gang struck the DSB both before and after the DSB brought out its study on the unfortunate happening.

The cybercriminal gang imitated a Secure File Transfer Protocol (SFTP) server of the DSB in last few days of September 2015 and then trailed that effort in mid-October with a fake VPN (Virtual Private Network) server. The security firm notes that this highlighted the first time it had openly documented an APT gang trying to gain entry via a VPN server.

With that being said, the DSB does hunt for short-term token authentication, but, these tokens could be phished away and don't essentially guard against one-time unauthentic access by 3rd parties if an Internaut falls victim to a phishing email, the company stressed.

The gang it appears set up phony OWA (Outlook Web Access) servers to attack the militaries, defense and external affairs ministries of those opposing Arab countries.

Ed Cabrera, VP of Cyber-Security Strategy with Trend Micro noted that the group has fairly clear targets, chiefly considering previous attacks on Polish gangs and Ukrainian campaigners, as published by SCMagazine.com on October 23, 2015.

This gang is clearly not going to depart and will carry on their activities and are extremely capable, said Cabrera. We will witness much more activity going ahead.

Pawn Storm is also suspected to be the mastermind of a cyber assault on France's TV5Monde TV when people, asserting to represent the Islamic State (IS), blacked out transmissions and positioned jihadist notifications on the station's site.

» SPAMfighter News - 10/28/2015