{"id":35211,"date":"2020-05-27T21:43:00","date_gmt":"2020-05-27T21:43:00","guid":{"rendered":"http:\/\/4b1648ee-b6a4-4362-9670-c169d0b8dcd0"},"modified":"2020-05-27T21:43:00","modified_gmt":"2020-05-27T21:43:00","slug":"google-highlights-indian-hack-for-hire-companies-in-new-tag-report","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/google-highlights-indian-hack-for-hire-companies-in-new-tag-report\/","title":{"rendered":"Google highlights Indian ‘hack-for-hire’ companies in new TAG report"},"content":{"rendered":"

\"hackers-are-actively-exploiting-zerodays-5e5e3102d7e6ce0001eb40a9-1-mar-03-2020-16-22-07-poster.jpg\"<\/span><\/p>\n

\n

Special feature<\/span><\/h3>\n
\"Cyberwar<\/span><\/a><\/div>\n

Cyberwar and the Future of Cybersecurity<\/a><\/p>\n

Today’s security threats have expanded in scope and seriousness. There can now be millions — or even billions — of dollars at risk when information security isn’t handled properly.<\/p>\n

Read More<\/a><\/p>\n<\/div>\n

The Google Threat Analysis Group (TAG), a division inside Google’s security department that tracks nation-state and high-end cybercrime groups, has published today its inaugural TAG quarterly report.<\/p>\n

In the Q1 2020 TAG Bulletin<\/a>, Google analysts chose to highlight two rising trends the company saw in the first three months of 2020.<\/p>\n

The first is the rising scene of hack-for-fire companies currently operating out of India, a country where such services have not been prominent until now.<\/p>\n

The second trend was the rising number of political influence operations carried out by governments across the world. This also marks the first time when Google publishes official disclosures of coordinated influence operations<\/a> that abused the company’s platforms.<\/p>\n

Indian hack-for-hire firms<\/h3>\n

According to Google, attacks that leveraged the coronavirus (COVID-19) theme were one of the most common trends the company saw among nation-state and high-end cybercrime operators in Q1 2020.<\/p>\n

While the company saw efforts from Chinese and Iranian hacking groups<\/a>, there was also a novel set of threat actors exploiting the coronavirus pandemic to launch cyber-attacks.<\/p>\n

“We’ve seen new activity from “hack-for-hire” firms, many based in India, that have been creating Gmail accounts spoofing the WHO,” said Shane Huntley, head of Google TAG.<\/p>\n

\n<\/section>\n

“The accounts have largely targeted business leaders in financial services, consulting, and healthcare corporations within numerous countries including, the US, Slovenia, Canada, India, Bahrain, Cyprus, and the UK.”<\/p>\n

Huntley says the email lures sent in these campaigns urged individuals to sign up for direct notifications from the WHO to stay informed of COVID-19 related announcements.<\/p>\n

The emails linked to attacker-hosted websites that resembled the official WHO website, but featured fake login pages that collected the potential victims’ Google credentials, and sometimes more, such as phone number.<\/p>\n

\"who-lookalike.png\"<\/span>

\"who-lookalike.png\"<\/span><\/p>\n

<\/noscript><\/p>\n

One of the fake WHO websites operated by Indian hack-for-hire companies<\/span><\/p>\n

Image :Google<\/span><\/p>\n

While there have been many hack-for-hire companies around the world, most are located in the UE, Israel, and some Arab countries. This is the first time that Indian companies are being singled out for their activities, and will most likely draw in more cyber-security firms looking to track their movements.<\/p>\n

According to the TAG group, these Indian hack-for-hire firms represent just a few of the more than 270 threat actors from more than 50 countries the Google TAG team is tracking.<\/p>\n

Lots and lots of coordinated influence operations<\/h3>\n

But the Google TAG group also said that they’ve also tracked and investigated more than hacking in the first three months of the year.<\/p>\n

TAG said they’ve been also looking into groups that have also engaged in coordinated social and political influence operations, since many of these operations are now taking place on Google’s network of sites, such as YouTube, the Play Store, AdSense, and the rest of its advertising platforms.<\/p>\n

In total, TAG said it tracked seven influence operations in Q1 2020, with some also being taking place and being exposed by Twitter and Facebook as well.<\/p>\n

January<\/strong><\/p>\n

Google terminated three YouTube channels as part of a coordinated influence operation linked to Iran.<\/p>\n

Google said it linked the campaign to the Iranian state-sponsored International Union of Virtual Media (IUVM) news organization, which was spreading IUVM content covering Iran’s strikes into Iraq and US policy on oil. More details about this campaign are also available in a report from Graphika<\/a>, a company using AI to study today’s social media landscape.<\/p>\n

February<\/strong><\/p>\n

Google also said it terminated one advertising account and 82 YouTube channels that were being used as part of a coordinated influence operation linked to Egypt.<\/p>\n

TAG experts said the campaign was sharing political content in Arabic that was supportive of Saudi Arabia, the UAE, Egypt, and Bahrain and was critical of Iran and Qatar.<\/p>\n

We found evidence of this campaign being tied to the digital marketing firm New Waves based in Cairo.<\/p>\n

Facebook also took action against this campaign<\/a> as well; campaign that was also detailed in another report from Graphika<\/a>.<\/p>\n

March<\/strong><\/p>\n

However, March has been Google’s most active month, with TAG cracking down on five different influence operations.<\/p>\n