{"id":36106,"date":"2020-07-16T10:05:00","date_gmt":"2020-07-16T10:05:00","guid":{"rendered":"http:\/\/2db23821-aa01-4c93-805b-5cdd43e9729c"},"modified":"2020-07-16T10:05:00","modified_gmt":"2020-07-16T10:05:00","slug":"iranian-cyberspies-leave-training-videos-exposed-online","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/iranian-cyberspies-leave-training-videos-exposed-online\/","title":{"rendered":"Iranian cyberspies leave training videos exposed online"},"content":{"rendered":"
\"itg18-video.png\"<\/span>
<\/span> Image:IBM X-Force <\/span><\/figcaption><\/figure>\n

One of Iran’s top hacking groups has left a server exposed online where security researchers say they found a trove of screen recordings showing the hackers in action.<\/p>\n

Discovered by IBM’s X-Force cyber-security division, researchers believe the videos are tutorials the Iranian group was using to train new recruits.<\/p>\n

According to X-Force analysts, the videos were recorded with a screen-recording app named BandiCam<\/a>, suggesting they were recorded on purpose and not accidentally by operators who got infected by their own malware.<\/p>\n

Videos showed basic account hijacking techniques<\/h3>\n

The videos showed Iranian hackers performing various tasks and included steps on how to hijack a victim’s account using a list of compromised credentials.<\/p>\n

Email accounts were primary targets, but social media accounts were also accessed if compromised account credentials were available for the target.<\/p>\n

X-Force described the process as meticulous, with operators accessing each and every victim account, regardless of how unimportant the online profile.<\/p>\n

This included accessing a victim’s accounts for video and music streaming, pizza delivery, credit reporting, student financial aid, municipal utilities, banks, baby product sites, video games, and mobile carriers, according to IBM X-Force. In some cases, operators validated credentials for at least 75 different websites across two individuals, they said.<\/p>\n

<\/section>\n

Hackers accessed each account’s settings section and searched for private information that might not be included in other online accounts as part of their efforts to build a profile as complete as possible about each target.<\/p>\n

IBM didn’t detail how the hackers obtained the credentials for each victim. It is unclear if the operators had infected the targets with malware that dumped passwords from their browsers, or if the operators had bought the credentials off the underground market.<\/p>\n

Other videos showed how to export account data<\/h3>\n

In other videos, the operator also went through the steps to exfiltrate data from each account. This included exporting all account contacts, photos, and documents from associated cloud storage sites, such as Google Drive.<\/p>\n

X-Force researchers say that in some cases, the operators also accessed a victim’s Google Takeout utility to export details such as the full content of their Google Account, including location history, information from Chrome, and associated Android devices.<\/p>\n

\"itg18-collected-data.png\"<\/span>