When Governments Attack: State Sponsored Malware Attacks Against Activists Lawyers and Journalists
summary
Research documents a targeted campaign against Kazakh dissidents, lawyers and journalists that uses off‑the‑shelf RATs rather than custom exploits: JRat and Bandook are deployed via spear‑phishing PDF lures, eight domains point to Windows XAMPP C2 servers, and investigators find 3–400 leaked emails tying Arcanum to Kazakh cases. Analysis shows overlaps with Operation Hangover/APen infrastructure but no confirmed zero‑days, concluding a likely contractor‑style operation rather than a cutting‑edge APT and many loose ends for follow‑up.
AI-written summary · about
chapters (10)
- 0:00Start
- 3:51The Computer Fraud and Abuse Act
- 7:44Targeted Malware Attacks
- 13:122015 Freedom House Report Describing the Freedom Situation in Kazakhstan
- 15:35Mukhtar Ablyazov
- 26:11Bandook
- 27:08Why Are these Attackers Using off-the-Shelf Malware
- 30:13Links to Kazakhstan
- 41:57Incident Response Malware Analysis
- 45:17Recap
related talks
17mRadRAT: An all-in-one toolkit for complex espionage ops
26mTracking the World's Dumbest Cyber Mercenaries
33mOperation GamblingPuppet: Analysis of a Multivector and Multiplatform Campaign Targeting Online ...
10mSurfacing from the Underbrush: Machete Pivots to Intrusion-Enabled Info Ops
55mRevealing the Attack Operations Targeting Japan
02h 46mWhen Governments Attack: Malware Targeting Activists, Lawyers, and Journalists
56mCybersecurity & Privacy From The Global Lens
19mOperation PZCHAO