Kaspersky exposes Operation Ghoul spear-phishing campaign

The series of attacks have been launched on the industrial and engineering sectors

Kaspersky Labs has uncovered a series of spear-phishing attacks on engineering and industrial firms, which has been dubbed Operation Ghoul because of its association with greed.

Operation Ghoul has so far attacked 130 countries across 30 countries including Spain, Pakistan, United Arab Emirates, India, Egypt, United Kingdom, and Germany.

It uses spear-phishing emails with malicious attachments sent to middle management as its weapon, disguised as emails sent from a bank based in the UAE. When a victim clicked on the attachment, which was usually presented as a SWIFT document, the malware was downloaded onto the computer.

The malware present on the victim's computer is based on the HawkEye commercial spyware, available on the dark web. It can collect a range of different data points from the user's computer including keystrokes, which could allow the hacker to break into accounts, FTP server credentials, account data from browsers, messaging clients, data from email clients and information about installed applications.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

This data can then be sent back to the hacker group and used to launch further attacks on the organisations. Members of Operation Ghoul could also sell the information on the dark web, allowing others to benefit from the company's data too.

"[Operation Ghoul's] main motivation is financial gain resulting either from sales of stolen intellectual property and business intelligence or from attacks on their victim's banking accounts," Mohammad Amin Hasbini, security expert at Kaspersky Lab said.

"Unlike state-sponsored actors, which choose targets carefully, this group and similar groups might attack any company. Even though they use rather simple malicious tools, they are very effective in their attacks. Thus companies that are not prepared to spot the attacks, will sadly suffer."

Featured Resources

What you need to know about migrating to SAP S/4HANA

Factors to assess how and when to begin migration

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

Best practices for implementing security awareness training

How to develop a security awareness programme that will actually change behaviour

Download now
Advertisement

Recommended

Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/microsoft-windows/32066/what-to-do-if-youre-still-running-windows-7
Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
Visit/operating-systems/25802/17-windows-10-problems-and-how-to-fix-them
operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020
Visit/policy-legislation/data-governance/354496/brexit-security-talks-under-threat-after-uk-accused-of
data governance

Brexit security talks under threat after UK accused of illegally copying Schengen data

10 Jan 2020
Visit/hardware/laptops/354533/dell-xps-13-new-9300-hands-on-review-chasing-perfection
Laptops

Dell XPS 13 (New 9300) hands-on review: Chasing perfection

14 Jan 2020