JACK: [MUSIC] One of my favorite adventurous activities I used to like doing when I was younger
was exploring abandoned buildings. I’ve been in abandoned schools, banks, industrial plants,
churches, hotels, mines, tunnels, and office buildings. It’s pretty dangerous but I liked
it. This one time I was exploring an old hospital with a friend and as we were walking through it,
we heard a noise in one of the rooms. We looked inside and there was a cat sitting
there, slowly waving its tail back and forth, staring at us. Right in the middle of the room
was an empty cat food bowl. The cat seemed to be living there and someone was feeding it.
It was strange but we kept walking down the long corridor of this abandoned hospital. We heard a
noise behind us. I quickly turned around and I swore I saw a door swing closed way at the end
of the hallway. But it was so far away and it was so quick that maybe I didn’t see it.
A lot of the windows were broken in this building and the wind was blowing
so I just stood there in the middle of the hall and I stared down it,
frozen, looking to see if any of the doors would just swing open or closed by themselves
but nothing. No movement. No sound. Did I see someone or was this my imagination?
This creeped us out so we went back down the hallway to leave. When we got to the room
where that cat was, we looked in it. The cat food bowl was now filled but the cat was nowhere to be
found. A few other doors that were open are now closed. Without seeing anyone at all, we knew for
sure someone was in this abandoned building with us. They probably saw us and were watching us.
We got out of there pretty quick after that and drove home. Have you ever been in a situation
like this though? Where you’re positive that something or someone was there watching you
but you couldn’t quite figure it out? JACK (INTRO): [INTRO MUSIC]
These are true stories from the dark side of the internet.
I’m Jack Rhysider. This is Darknet
Diaries. [INTRO MUSIC ENDS] JACK:
We have a big story here and there’s a lot to cover so let’s just get right into it and meet our
guest. What’s your name and what do you do? COOPER: One second.
JACK: It’s not a hard question. COOPER: [LAUGHTER]
I got to think about which name I want to use. No, no, I actually needed a drink of water
all of a sudden. JACK: Oh, okay.
COOPER: I’m Cooper Quinton. I am a senior staff technologist on EFF’s Threat Lab.
JACK: Threat Lab? There’s a Threat Lab at EFF?
COOPER: Yeah. Electronic Frontier Foundation has a new project called Threat Lab. Our mission is
to research and help stop targeted threats against at-risk populations. This is like lawyers, human
rights lawyers, activists, journalists around the world that are being targeted with malware
or other digital surveillance techniques. JACK: Let’s back up here for a minute. The EFF
is the Electronic Frontier Foundation. It’s a non-profit organization and it has a goal
of protecting our civil liberties online. We have them to thank for standing up for us when
our digital rights are being threatened. It’s a great group of people, full of [00:05:00] lawyers
and activists and researchers, and Cooper here is working with them in their Threat
Lab. But the Threat Lab is actually a brand-new thing within the EFF and there’s an interesting
story about how all that came to be and it all starts with Operation Manul?
COOPER: Yes, Operation Manul. JACK: What’s a manul?
COOPER: It’s named after the manul cat, or Pallas cat which is native
to the steps of Kazakhstan. JACK: Okay, so there’s a cat on
the steps of Kazakhstan. COOPER: It’s a really expressive
amazing cat and I highly recommend looking up pictures of the manul.
JACK: This is great. There’s like, exotic creatures and places in
this story already. I love it. Go on. COOPER: Operation Manul started when the EFF was
representing a woman named Irina Petrushova who is the Editor in Chief of Independent Newspaper
which is formally out of Kazakhstan called Respublika. Respublika had been Kazakhstan’s
only source of independent journalism. JACK: Right. Here’s the first person of our story,
Irina Petrushova. Not only is she a reporter for Respublika but she’s also the founder of
this independent news source in Kazakhstan. Specifically, she was writing stories and doing
reporting on the corruption that goes on within the government of Kazakhstan. There were a series
of financial scandals that she wrote about and the president often hires family and friends to fill
certain roles even though there are people much more qualified and willing to fill those roles.
You should know a little about the President of Kazakhstan. This is the first
President of Kazakhstan ever. He came to power in 1990 and he stayed there
until he retired this year. Yeah, there were ‘elections’ but they didn’t appear to be free
or fair at all. Some even go so far as to say Kazakhstan is an authoritarian regime.
When Irina published articles exposing the corruption of this authoritarian regime,
somebody really didn’t like this and wanted to do everything they could to keep Irina quiet.
COOPER: [MUSIC] Okay, so first they kill her dog and leave the head of the dog at
the front door of the building where they published Respublika from.
JACK: Jeez. COOPER: Then they leave a human skull
in front of her office building with a note pinned to it saying, “There will be no next time.”
Then they followed that up with fire-bombing her office. The office burned to the ground and that’s
when she finally left Kazakhstan. JACK: She fled the country and moved to
Russia. She thought maybe the government of Kazakhstan was behind these personal threats
but she didn’t stick around to find out. She was scared for her life. But she
continued to write for Respublika and publish articles about the government of Kazakhstan
and one day a big story showed up. COOPER: This giant dump of e-mails appeared
online on a website called Kazaword. [MUSIC] These were e-mails leaked from Kazakhstan’s
government from Kazakhstan’s president. JACK: When this giant dump of e-mails showed up
on another website, Irina published stories about it. The Kazakhstan
government was very upset again with Irina and decided to try to silence her.
COOPER: The government of Kazakhstan sued Respublika and Irina Petrushova in New
York district court, claiming that they were responsible for this Kazaword dump of documents
and tried to get their – Respublika’s reporting on this dump of documents
taken down from the internet. JACK: The case gets under way in New
York. Irina needed some help with this. COOPER: At this time Irina contacted us for
legal help and we started representing her in court because this would obviously be
a violation of the First Amendment. JACK: Yeah, it is a violation. Journalists
are allowed to publish documents that are factual in nature. This judge looked favorably on Irina
and the EFF and said Respublika does not need to take down the articles about the leaked e-mails
which was a victory for Irina and the EFF, and perhaps historically the EFF would have stopped
there and that would have been the end of the case. But the EFF has a new interest in malware
that is associated to things like this now. COOPER: At that same time, she and her brother who
is also an editor started receiving spear phishing e-mails which were designed to look like they were
coming from other activists in Kazakhstan and human rights lawyers working with Kazak people.
The spear phishing e-mails contained attachments that looked like Word docs or PDFs
but which were, in fact, malware. JACK: One of the things the EFF does is educate
people on the dangers of being a journalist that might be a target for hackers.
COOPER: Yes, exactly. We had given her some security training and when she got these
e-mails, she thought they were a little bit suspicious. She sent them to us. [00:10:00] We
started looking at them quickly, figured out that the attachments were malware, and then
started taking apart the malware to figure out what might be the source of this.
JACK: This team from EFF started investigating these Word docs and PDF docs. They found that
when you open these attachments it will go download a piece of malware called jRat.
COOPER: You imbed an exploit in a PDF or a Word doc that the person opens and
then that exploit goes and downloads and installs jRat. Then once jRat is running
it can do a lot of different things. It can turn on your camera, it can capture your screen,
it can record audio ambiently in the room, it can go through your files on your computer and
create files or delete files or download files. You can spawn a shell to remotely run commands on
the computer, and a bunch more stuff. The neat thing about jRat is that it works on Windows,
Linux, and Mac computers. JACK: The Rat part of this jRat malware stands
for Remote Access Trojan which means when a user gets infected with jRat the hacker can then remote
control that computer, allowing them to download stuff or interact with that computer. At the time
you could buy this piece of malware at jrat.io for about forty dollars in Bitcoin. This wasn’t
a sophisticated or expensive piece of malware at all. But a few more e-mails came in with
more attachments and a second piece of malware which also was discovered called Bandook.
COOPER: Specifically, Bandook was developed by a guy who goes by the name Prince Ali.
JACK: We’ll learn more about Prince Ali later but Bandook did a lot of the same things that
jRat did. Now, as Cooper and the team at EFF discovered this, they knew they were
dealing with something more serious. COOPER: [MUSIC] The first reaction is like
wow; we really have something here. This isn’t just crimeware. This isn’t somebody trying to
steal her credit cards. This is actually somebody trying to undertake digital espionage, right, this
is somebody actually trying to spy on her. JACK: See, there are a few types of hackers out
there; there’s the common crimeware hackers which usually are a spray-and-pray kind of
hacking. They’ll just scan the whole internet looking for vulnerabilities or they’ll send
out thousands of phishing e-mails. But then there are the targeted hackers. These people
have a specific objective on a target. Because these phishing e-mails were crafted just for
Irina personally, and the malware wasn’t like a Bitcoin miner or ransomware or anything,
then this likely means somebody was actively trying to spy on her. It’s scary and dangerous
to be the target of a hacker like this. COOPER: We inform her and she informs her
friends and her family and her staff. They start sending us more suspicious e-mails.
We get a bunch and we get a bunch that all contain jRat or the other malware called Bandook.
JACK: Her brother started getting phishing e-mails, her family, other people at Respublika,
and she was getting more e-mails too. This was getting more serious now.
COOPER: [MUSIC] We started looking into the malware and we find the command and
control servers. These are the servers that the malware actually talks to. These are
the servers that the malware sends any files that it gets back to. Basically,
these are the servers that let the person running the malware tell the malware what to do.
JACK: With malware like this, there’s often an intermediary computer that files are staged on,
uploaded to, and connections are made. That’s what this command and control server is.
When you open a PDF, your computer will then download the malware from that server
and when you get infected, your computer will upload data to that server.
You need the server in order for the malware to be successful. The team at EFF discovered
eight different domain names used by this malware and two different command and control servers.
Each of them were hosted by companies notorious for hosting possibly illegal content
and protecting its users. Yeah, again, this doesn’t seem like your typical crimeware.
COOPER: We figured that at least the people who were going after Respublika and after
Irina Petrushova were likely doing this on behalf of the government of Kazakhstan. The
government of Kazakhstan is clearly after her. They’re clearly very upset with her for posting
negative things about the government. JACK: But see, it’s hard to tell for sure.
There just isn’t any smoking gun. It’s kind of like a puzzle where most of the pieces
are all together and you can pretty much tell what the puzzle’s going to look like
but you still need that final few pieces to really know for sure. Okay, remember those
e-mails [00:15:00] that got leaked which were the official Kazakhstan government e-mails?
One of them stood out to Cooper. COOPER: One of the things we learned from
the dump of e-mails is that the President of Kazakhstan had taken out a contract
with a private intelligence company called Arcanum Global Intelligence to perform what
they called a surveillance data extraction and full spectrum cyber-operation mission to surveil
Kazakhstan’s only opposition politician whose name is Ablyazov. His last name is Ablyazov.
JACK: We just got started. We haven’t even got to the good stuff yet and already I’m just blown away
by the magnitude this whole thing is. COOPER: Oh, it’s crazy. This is the deepest
rabbit hole I’ve ever been down. JACK: Okay, so there’s sort of a smoking gun that
says Kazakhstan has historically hired independent hacking teams to spy on the enemy.
COOPER: The interesting thing and sort of the thesis that I want to get at is that it’s not
that Kazakhstan has any cyber-skill. I hate using that word but let’s go with it.
JACK: Okay. COOPER: It’s not that
they have any – I’m sure there are many fine hackers in Kazakhstan, right, but
the government does not have a cyber-war unit. They don’t have what is it, Israel’s…
JACK: 8200? Mossad? COOPER: Yeah, 8200, exactly. But
what they have is companies that do have this capability that are more than happy to sell it to
any nation state that will pay. JACK: These for-hire hacking teams
really fascinate me and that’s something I’m gonna have to dig into for a future episode
because there are a lot of groups like this which will carry out hacks or spying or doing
signals intelligence for clients. COOPER: Because we know this is something
that – digital surveillance, digital extraction missions, is the term they use, we know that that
is something Kazakhstan is interested in. All of that spear phishing e-mails seem to demonstrate a
pretty good knowledge of Kazakhstan; of politics in Kazakhstan and what might entice Kazak
activists to click through and open e-mails. The majority of the targets that we found were either
embroiled in legal disputes with the government of Kazakhstan or are the family members or associates
of people involved in those disputes. We feel like we have a pretty good link to Kazakhstan although
no – it’s all circumstantial evidence. JACK: They also discovered some malware activity
on mobile phones. What they found were… COOPER: Files that looked like they were
uploaded from mobiles phones which led us to believe that there was probably
a mobile component to this campaign, although we never actually found, at the time of publishing,
we never found the mobile malware. JACK: Eva Galperin was also a big part of
this research. You might know her from Twitter as @evacide. Cooper and Eva
put this data together and put it in a report called Operation Manul.
Again, manul being a native cat to Kazakhstan, and they just like cats
so why not? The report was published and they gave a presentation at Black Hat,
a big security conference in Las Vegas. HOST: Our talk today is presented by Cooper
Quinton and Eva Galperin. [APPLAUSE] EVA:
Hi there. Welcome to When Governments Attack, also known as I Got A Letter
from the Government the Other Day Because I Couldn’t Resist A Public Enemy Reference.
We’re gonna be talking a little bit about… JACK: People were a little freaked out with
this report, concerned about how easy it is for Kazakhstan to ramp
up a cyber-espionage program by outsourcing it. People wondered how far does this spying go?
At the end of the Black Hat talk, Eva said… EVA: I’m fairly certain that Cooper and I
are less good at this than many of the people who are in this room right now.
I beg you to go look at our report and see the many loose ends that we have left,
the many areas in which more research is needed. It would not be that difficult for
people with more skills than us and more resources than us to be helpful.
JACK: [MUSIC] This call for help worked. A few new people saw this report and looked into it and
found some things that they could help with. When we come back, we’ll hear what they found.
COOPER: Unbeknownst to us, two researchers at Lookout, the mobile security company, took an
interest in this report. Specifically, they took an interest in the part of the report that said
we believe that there are [00:20:00] mobile components to this based on exfiltrated mobile
files that we found but we weren’t able to find the samples. Lookout, being a mobile
security company, has a big database of mobile malware and of the samples and of the domains
that they’ve seen, the malicious domains that they’ve seen. Mike and Andrew, the researchers at
Lookout, start coming through their database and after a little while they find some malware
which is talking to the same domains that we had discovered in the Operation Manul report.
[MUSIC] At this point they reach out to us and they say hey, we have this
interesting mobile malware. We would love for you guys to take a look at it. We think
that it’s related to Operation Manul. JACK: The team at Lookout called this mobile
malware Pallas, P-A-L-L-A-S, which is the other name for the manul cat. They decided to get
together and come to an agreement. COOPER: Our arrangement was okay,
they will look into the mobile malware. We will sort of consult with them and think,
write a blog post together, and think about what this might mean geopolitically.
JACK: The team at EFF and the team at Lookout, they team up and they find a couple of new things
related to this whole campaign. COOPER: We were about to publish a small
blog post saying hey, we found some more mobile malware related to Operation Manul. Here it is and
that’s all, folks. When I remembered that several months ago when I was researching Operation Manul,
we had found all the uploaded files from the malware, from people’s infected computers
on the command and control servers. JACK: When Cooper was investigating Operation
Manul, he watched how the malware behaved and he noticed that it does things like take screenshots,
and then uploads that to the command and control server. It puts them in a specific directory.
Well, it just so happens that that directory was visible to anyone on the internet.
COOPER: In other words, the data was in a location on the file system that you could visit with a
web browser without authentication or anything, without even an index file
that would hide the file names. One of the servers was example.com and you would go to
example.com/forwardlettercampaignid/pictures and you would see the list of every picture
that had been uploaded by that infection. JACK: Whoa, this is a big deal. Cooper had the
ability to view and download all the data that this hacking crew had stolen from its victims.
This is what Cooper used to build his report on but forgot to mention
it to the Lookout team until just now. COOPER: I went to Lookout. They said oh hey,
do you think that it might be useful to look at some of this exfiltrated data? Their jaws
dropped and they were like are you kidding me? Yes! Why didn’t you say this months ago?
Yes, Jesus, give us the URLs. This was like, two days before we were gonna publish this little blog
post, right. I showed them the data. We started looking at the data and we were like oh wait,
there’s actually something much bigger going on here. This looks like a totally new target.
JACK: It was a target that wasn’t Kazakhstan-related, is
that what you’re saying? COOPER: Exactly. It was a target that wasn’t
Kazakhstan-related. We start downloading all the data that we could find and we end up with several
gigabytes’ worth of data. It’s pretty similar data from what we got before; audio recordings,
video recordings, files, but we also found SMS messages, call records, WhatsApp, Telegram,
and Skype databases, and WiFi details. JACK: This data provides the Lookout team a lot
more information to investigate but not only that. There appears to be more victims since
the report was published. The teams decided not to publish a blog post because the investigation
just got a lot more interesting. COOPER: Exactly. That’s exactly what
happened. This is way bigger than what you’re looking at. We start looking into this new data
and we quickly discover that most of the infections are infections of people
in Lebanon [MUSIC] or on the border of Lebanon and Syria. Looking through it, it appears to be
mostly Lebanese civilians. There’s also some military people in there, there’s
some activists in there, just a really wide swath of Lebanese society.
JACK: Okay. [00:25:00] When you see okay, Lebanon; this is getting bigger.
What is going through your mind now? COOPER: Yeah, so now it’s a real mystery because
previously we had assumed that this was the work of a company working on behalf of Kazakhstan,
right? But why would the government of Kazakhstan be spying on Lebanese civilians?
JACK: What’s the relation between Kazakhstan and Lebanon?
COOPER: There’s not much of a relationship, actually. Or vice versa, if this is the Lebanese
why would they be spying on Kazak citizens? JACK: Hm. This is kind of blowing the theory now
that the hackers behind this might be from the Kazakhstan government. All of a sudden,
the motives and signals just don’t add up. The teams keep analyzing the data,
poring through gigs of photos and text messages and e-mails and keystrokes and WiFi hotspot data
and more. Everything this malware would upload to the server the team would then
download and take a look at it. Then they found another victim; a Vietnamese cigarette importer
and this confused them even more. Around this time Lookout positively identifies the mobile malware
being used in this hacking campaign. COOPER: The malware itself is pretty standard
spyware stuff. JACK: Typical spyware
mobile malware will enable the microphone, copy text messages, e-mails, turn the camera on, read
your private messages, that sort of thing. COOPER: But what’s interesting about it is that it
is masquerading as encrypted messaging applications.
The malware is disguised as copies of WhatsApp, Signal, Telegram, Tor, and Threema.
The attackers have actually set up a website called secureandroid.info that has the back door
to Trojanized copies of all of these apps. JACK: Doing a little bit more investigation,
the teams figured out how this whole thing went down. [MUSIC] The
hackers would send an e-mail or a text to an Android phone user saying hey, we need to
talk but let’s do it in a secure way. Download WhatsApp from this URL and then we can have a
secure chat. The link to download the app would be to the hacker’s version of WhatsApp.
COOPER: The really interesting thing is these were all, in addition to being spyware,
working versions of the app still. When you downloaded this fake version of WhatsApp or this
fake version of Signal you would be able to use it like the real version of WhatsApp or of Signal but
it would also be spying on you in the background, decrypting your encrypted messages, and sending
them to the command and control server. JACK: The teams at Lookout and EFF kept seeing
more and more data being uploaded to the command and control servers which gave them
so much more stuff to go through. They were seeing many more than six domain names that
were being run by this hacker crew. COOPER: We found over twenty domains that were
connected with this campaign. The domains were things like adobeair.net, tweetsfb.com,
of course secureandroid.info which is hilarious to this day because all it had was insecure android.
Arablivenews.com, and the one I mentioned before, axroute.com,
skypeupdate.com, and a bunch more. JACK: Each of these sites had a different
purpose in this attack. For instance, secureandroid.info
was where e-mails would point the victim to download the malicious program
and tweetsfb.com had exact replicas of the Twitter and Facebook login pages which were
probably used to trick users to enter their username and password in order to steal their
logins. Some of these other domains were used to upload the stolen data to. The whole time, tons
more victims are being hit with this which means tons more data is being uploaded to these servers,
data which Cooper and the team can see. COOPER: We find just a massive amount of data.
We found 81 gigabytes of data just on adobeair.net.
JACK: Oh my gosh. It’s all adding up in my head now. You have behind the scenes access to all the
files these hackers are stealing and it’s tons of data and it’s very sensitive, private stuff. Are
you downloading it all and looking at it? COOPER: Yeah, and I’ll tell you Jack, it’s heavy
stuff to look at because you have to look through all this data to figure out who the victims are,
who the threat actors are. You’re really looking through people’s very [00:30:00] personal data.
You start looking through the pictures uploaded from people’s phones and you see pictures of
people’s kids and pictures from war zones. You have to find ways to look through all
these things to try to figure out what’s going on here and try to figure out are these victims
related to each other in some way? Why are they being spied on?
It’s awful. You feel like a terrible human being and you have to stop.
JACK: The team combs through the data photo by photo, text by text and they would piece
together the puzzle. They would figure out how the victim got infected by looking for
suspicious text messages of people asking them to download an app. They’d try to find info on
this victim like where they are in the world and what their job was, and why they might be the
target for this kind of spyware attack. COOPER: Exactly. At some point what we did was
just started to write a script that would take the IP addresses of all the victims
and map them out in the world. JACK: [MUSIC]
Using GeoIP Lookup tools you can see what city that IP comes from in the world. The
map they made displayed victims being all over the world, not just Kazakhstan and Lebanon
but so many more countries. COOPER: In this map we’ve got victims in
Lebanon, Kazakhstan, the United States, China, France, Germany, India, Italy, Jordan, Nepal,
the Netherlands, Pakistan, the Philippines, Qatar, Russia, Saudi Arabia, South Korea, Switzerland,
Syria, Thailand, Venezuela, and Vietnam. JACK: Holy cow.
COOPER: All over the world.