Middle East officials targeted by cyber espionage 'Madi' attackers
Hacking group attacked critical infrastructure in Iran and Israel in eight-month spying campaign
guardian.co.uk, Tuesday 17 July 2012 14.09 BST
Government officials in the Middle East are among 800 victims of a sustained cyber espionage attack dubbed Madi targeting critical infrastructure in Iran and Israel, security experts have discovered.
A sophisticated hacking group, whose members moved its servers from the Iranian capital Tehran to Canada in January 2012, stole hundreds of sensitive documents from the officials and businesspeople in an eight-month spying campaign. That began in December 2011, researchers from the security firms Kaspersky Labs and Seculert have told the Guardian.
Email and Facebook accounts belonging to the victims were also spied on during the attack, which follows a string of attempts to snoop on top-secret projects in the Middle East.
Researchers believe the attack, revealed for the first time on Tuesday, was coordinated from four bases in Canada by a group of Farsi-speaking hackers. It is not known whether the cyber espionage was state-sponsored.
Aviv Raff, chief technology officer of Seculert, told the Guardian: "Most of these 800 victims are from Middle Eastern countries, starting with Iran, then Israel, then Afghanistan, and are all from critical infrastructure companies, financial services and even government officials."
The attack secretly downloaded the Madi spying software on to a victim's computer when they downloaded an email attachment, usually in the form of an innocent-looking Microsoft PowerPoint file.
Once downloaded, the software installed a keylogger able to record every keystroke on the target's computer, to track login details for sensitive websites. The Madi malware could also take screenshots of a victim's computer activity – most commonly their email exchanges and social networking habits – and record audio. Gigabytes of data has been stolen from victims' computers over the eight-month period, the researchers said.
"While the malware and infrastructure is very basic compared to other similar projects, the Madi attackers have been able to conduct a sustained surveillance operation against high-profile victims," said Nicolas Brulez, a senior malware researcher at Kaspersky Lab.
Unlike more commonly known spam emails, researchers said these messages were designed deliberately for their targets and not sent to tens of thousands of people across the world.
Some of the emails attached a PowerPoint presentation or a Word document, and others had a video of a missile test, pictures of a nuclear explosion and an image of Jesus. Another email contained a copy of a Daily Beast article discussing Israel and Iran.
Raff, from Seculert, said: "There's definitely a religious thing. They are trying to lure people to open these emails."
News of the latest cyber surveillance plot follows a string of other data snooping attempts discovered in the past 12 months. Two of the most complex online attacks ever discovered – Stuxnet and Flame – were revealed to have covertly targeted Tehran, in an attempt to sabotage Iran's nuclear program.
• This article was amended on 18 July to reflect the fact that it was the hacking group's servers that were located in Canada, not the members of the group themselves