Recent Trojan Computer Attacks on Israeli Police, Foreign Ministry and Embassies<\/em><\/p>\n SAN DIEGO, November 12, 2012<\/strong>\u00a0\u2013 An in depth analysis of millions of malware samples dating back to October 2011, has revealed that many of the recent attempts by the Israel government to prevent Trojan injections into sensitive police, ministry and embassy computers, may have been too late.\u00a0 According to Norman Shark, a leading malware analysis firm with offices in Oslo, Norway and San Diego, California, multiple malware attacks against Israeli and Palestinian targets have been going on for at least a year\u2014first focused on Palestinian, then Israel. A few weeks ago, Israeli law enforcement discovered messages wrongly identified as coming from Israeli Defense Force Chief of Staff Benny Gantz.\u00a0 This was their first notice of a possible attack.\u00a0 Similar messages had also gone out to Israeli embassies around the world.\u00a0 When unsuspecting recipients opened the email, they found an archive attached containing a surveillance tool camouflaged as a document. When opened, hackers could steal information and remotely take control of the computer.<\/p>\n In an attempt to discover if this was an isolated incident or something more significant, Norman Shark researchers ran samples from Norman Shark\u2019s large database of known malware through the company\u2019s malware analyzer.\u00a0 It appears that the attacks were performed by the same attacker, as the malware in question communicate with the same command-and-control structures, and in many cases are signed using the same digital certificate.\u00a0 While unknown at this point, the purpose is assumed to be espionage and surveillance.<\/p>\n Norman Shark Vice President Einar Oftedal, is available to provide additional details and commentary on this news and Norman Shark\u2019s analysis.<\/p>\n The hackers first directed malware network traffic to command and control servers in the Gaza Strip, and then to hosting companies in the U.S. and U.K. according to the investigation.<\/p>\n \u201cThe attacker is still unknown to us\u201d commented Oftedal.\u00a0 \u201cThere are several possible alternatives based on the various power blocks in the region.\u00a0 One thing is for certain, with off-the-shelf malware available to anyone, the cost of mounting such an operation is low enough that anyone could be behind it.\u201d The malware used was in most cases shown to be XtremeRat, a commercially-available surveillance and remote administration tool.<\/p>\n Stein Surlien, CEO Norman SharkContact Information<\/h1>\n<\/div>\n<\/section>\n
\nMob:+ 47 911 16\u00a0240 Email:\u00a0stein.surlien@norman.com<\/a><\/p>\n