April 13, 2017 |

Leaked HackingTeam Spyware used by Attack Group to Collect Intelligence

F-Secure Labs uncovers cyber attack group collecting intelligence on foreign and security policy in Europe using spyware developed for law enforcement agencies.

Helsinki, Finland – April 13, 2017: A new report published by F-Secure Labs claims that a previously unknown cyber attack group has been conducting intelligence gathering on foreign and security policy in Eastern Europe and the South Caucasus. The report describes the Callisto Group as a highly motivated and well-resourced threat that’s been conducting cyber attacks on military personnel, government officials, journalists, and think tanks since at least 2015.

According to the report, the Callisto Group is responsible for several attacks in 2015 and 2016. And while the report does not identify specific victims, it does say the common theme amongst the group’s targets is a connection with foreign and security policy involving Eastern Europe and the South Caucasus, suggesting intelligence gathering as the group’s motive.

The report notes that the group’s infrastructure has links with entities in Russia, Ukraine, and China, but does not offer definitive conclusions about who is behind the group. The report also highlights that while there is evidence suggesting the group has ties with a nation-state, the specifics of that relationship are unclear.

“They act like nation-state attackers, but there’s also evidence linking them with infrastructure used by criminals,” said F-Secure Security Advisor Sean Sullivan. “So they could be an independent group that’s been contracted by a government to do this work, or possibly doing it on their own with the intent of selling the information to a government or intelligence agency. But there are several explanations in addition to these, and we can’t say one way or the other based on the current evidence.”

In addition to discussing the Callisto Group’s targets and motives, the report details the attack pattern the group uses to compromise their targets. According to the report, the Callisto Group use highly targeted phishing attacks to steal credentials for email accounts, as well as highly personalized, convincing spear phishing emails intended to infect their targets with malware. These spear phishing emails were often sent from email accounts compromised by the group’s previous phishing attacks.

The malware delivered by these spear phishing emails was designed to steal information from their targets, as well as infect them with additional malware. The report notes that this malware is a variant of the Scout tool developed by Italian surveillance firm HackingTeam. The Scout tool was part of a spyware toolset HackingTeam sold to government agencies that was stolen and leaked online in 2015.*

According to F-Secure’s Chief Information Security Officer Erka Koivunen, the Callisto Group’s use of spyware designed for law enforcement is a stark reminder of the dangers of surveillance technologies.

“The adoption of government-grade spyware by attackers shouldn’t surprise anyone. Surveillance tools are by their very nature designed to invade people’s privacy. In well-functioning democracies these invasions are mandated by laws, and citizens rely on authorities to use them responsibly with proper checks and balances in place,” said Koivunen. “But data breaches and subsequent leaks of professional-grade surveillance tools give these invasive capabilities to a range of different threats. This should remind governments that we don’t have monopolies on these technologies, and that mercenaries, hostile nation-states, and other threats won’t hesitate to use these surveillance powers against us.”

The report highlights that the group remains active, and that how they’ll respond to being discovered is unknown. It also provides indicators of compromise and mitigation strategies for any potential targets concerned about the Callisto Group or other threats using similar attacks. F-Secure products currently feature behavioral, generic, and other detections to protect users from Callisto Group activity.

*Source: https://arstechnica.com/security/2015/07/hacking-team-gets-hacked-invoices-show-spyware-sold-to-repressive-govts/

More Information:
Callisto Group
News from the Labs – The Callisto Group

About F-Secure

Nobody knows cyber security like F-Secure. For three decades, F-Secure has driven innovations in cyber security, defending tens of thousands of companies and millions of people. With unsurpassed experience in endpoint protection as well as detection and response, F-Secure shields enterprises and consumers against everything from advanced cyber attacks and data breaches to widespread ransomware infections. F-Secure’s sophisticated technology combines the power of machine learning with the human expertise of its world-renowned security labs for a singular approach called Live Security. F-Secure’s security experts have participated in more European cyber crime scene investigations than any other company in the market, and its products are sold all over the world by over 200 broadband and mobile operators and thousands of resellers.

Founded in 1988, F-Secure is listed on the NASDAQ OMX Helsinki Ltd.

f-secure.com twitter.com/fsecure | facebook.com/f-secure

F-Secure media relations
Adam Pilkey
+358 40 637 8859

Downloads & other Goodies


Latest Press Releases

June 9, 2020

Overwhelming identity theft risks demand a new approach to securing personal information

F-Secure launches ID PROTECTION to fight back against data breaches with a fast and comprehensive solution for data security.

June 4, 2020

Stalkerware makes invasive surveillance more personal than ever

F-Secure joins the Coalition against Stalkerware to help expand the company’s approach to safeguarding personal information. 

May 29, 2020

A start button for securing cloud-based email

F-Secure Cloud Protection for Microsoft Office 365 is built to secure inboxes as businesses move to cloud-based email services.

May 26, 2020

Research finds Android handsets suffer from region-specific security issues

Region-specific settings and configurations leave users vulnerable in some countries but not others.   

%d bloggers like this: