Leaked HackingTeam Spyware used by Attack Group to Collect Intelligence

Helsinki, Finland – April 13, 2017: A new report published by F-Secure Labs claims that a previously unknown cyber attack group has been conducting intelligence gathering on foreign and security policy in Eastern Europe and the South Caucasus. The report describes the Callisto Group as a highly motivated and well-resourced threat that's been conducting cyber attacks on military personnel, government officials, journalists, and think tanks since at least 2015.

According to the report, the Callisto Group is responsible for several attacks in 2015 and 2016. And while the report does not identify specific victims, it does say the common theme amongst the group's targets is a connection with foreign and security policy involving Eastern Europe and the South Caucasus, suggesting intelligence gathering as the group's motive.

The report notes that the group's infrastructure has links with entities in Russia, Ukraine, and China, but does not offer definitive conclusions about who is behind the group. The report also highlights that while there is evidence suggesting the group has ties with a nation-state, the specifics of that relationship are unclear.

"They act like nation-state attackers, but there's also evidence linking them with infrastructure used by criminals," said F-Secure Security Advisor Sean Sullivan. "So they could be an independent group that's been contracted by a government to do this work, or possibly doing it on their own with the intent of selling the information to a government or intelligence agency. But there are several explanations in addition to these, and we can't say one way or the other based on the current evidence."

In addition to discussing the Callisto Group's targets and motives, the report details the attack pattern the group uses to compromise their targets. According to the report, the Callisto Group use highly targeted phishing attacks to steal credentials for email accounts, as well as highly personalized, convincing spear phishing emails intended to infect their targets with malware. These spear phishing emails were often sent from email accounts compromised by the group's previous phishing attacks.

The malware delivered by these spear phishing emails was designed to steal information from their targets, as well as infect them with additional malware. The report notes that this malware is a variant of the Scout tool developed by Italian surveillance firm HackingTeam. The Scout tool was part of a spyware toolset HackingTeam sold to government agencies that was stolen and leaked online in 2015.*

According to F-Secure's Chief Information Security Officer Erka Koivunen, the Callisto Group's use of spyware designed for law enforcement is a stark reminder of the dangers of surveillance technologies.

"The adoption of government-grade spyware by attackers shouldn't surprise anyone. Surveillance tools are by their very nature designed to invade people's privacy. In well-functioning democracies these invasions are mandated by laws, and citizens rely on authorities to use them responsibly with proper checks and balances in place," said Koivunen. "But data breaches and subsequent leaks of professional-grade surveillance tools give these invasive capabilities to a range of different threats. This should remind governments that we don't have monopolies on these technologies, and that mercenaries, hostile nation-states, and other threats won't hesitate to use these surveillance powers against us."

The report highlights that the group remains active, and that how they'll respond to being discovered is unknown. It also provides indicators of compromise and mitigation strategies for any potential targets concerned about the Callisto Group or other threats using similar attacks. F-Secure products currently feature behavioral, generic, and other detections to protect users from Callisto Group activity.

*Source: https://arstechnica.com/security/2015/07/hacking-team-gets-hacked-invoices-show-spyware-sold-to-repressive-govts/

More Information: Callisto Group News from the Labs – The Callisto Group

About F-Secure

F-Secure makes every digital moment more secure, for everyone. We deliver brilliantly simple, frictionless security experiences that make life easier for the tens of millions of people we protect and our 170 service provider partners. For more than 30 years, we’ve led the cyber security industry, inspired by a pioneering spirit born out of a shared commitment to do better by working together.

f-secure.com | twitter.com/fsecure | linkedin.com/f-secure

F-Secure media relations

Adam Pilkey

PR Content Manager

+358 40 637 8859

Press list

Sign up for media information from F-Secure.

We process the personal data you share with us in accordance with our Corporate Business Privacy Policy.

Press archive

By year

Browse through our news by year.

By category

Browse through our news by category.