Strategic Web Compromises in the Middle East with a Pinch of Candiru
summary
Built a Nikola‑style scanner that analyzes 6,000 websites daily and flags suspicious JavaScript, discovering over twenty high‑profile sites primarily in the Middle East (governments, media, defense contractors, a medical conference). Compromises use domains impersonating analytics or URL shorteners, clone sites when needed, and use fingerprinting to whitelist targets (Windows/macOS browsers only); researchers never retrieve final payloads. Passive DNS and server fingerprints reveal ~20 CNC servers (Jan–Jun 2021) and infrastructure ties that link to Candiru / the “Saudi‑Linked Cluster.”
AI-written summary · about
chapters (7)
- 0:00Introduction and background
- 1:08Watering hole methodology
- 4:12Strategic web campaign 2020
- 8:04Technical script analysis
- 10:532021 campaign observations
- 17:26Connection to Candiru spyware
- 20:32Conclusion and collaboration
related talks
47mDNS On Fire
01h 04mServer-Side Browsing Considered Harmful
01h 01mSomething Something Cyber
37mAutomatic Extraction of Indicators of Compromise for Web App.
36mBehind Enemy Lines:Engaging and Disrupting Ransomware Web Panels
56mCybersecurity & Privacy From The Global Lens
40mHostile JavaScript: Attacking and Defending the Browser
33mHacking The Front-End