Deadeye Jackal

🔴 High
Also known as: ATK 196, Deadeye Jackal, SEA, Syria Malware Team, Syrian Electronic Army, Syrian Electronic Army (SEA), SyrianElectronicArmy, TAG-CT2

The Syrian Electronic Army (SEA) is a group of computer hackers which first surfaced online in 2011 to support the government of Syrian President Bashar al-Assad. Using spamming, website defacement, malware, phishing, and denial of service attacks, it has targeted political opposition groups, western news organizations, human rights groups and websites that are seemingly neutral to the Syrian conflict. It has also hacked government websites in the Middle East and Europe, as well as US defense contractors. As of 2011 the SEA has been the first Arab country to have a public Internet Army hosted on its national networks to openly launch cyber attacks on its enemies. The precise nature of SEA’s relationship with the Syrian government has changed over time and is unclear

🌍 Country Syria
⚡ Risk Level High
Country Defense Opposition Political party News - Media Government, Administration

Associated Operations

2016 Mid 2018-01 In recent years Lookout researchers have uncovered a long-running surveillance campaign tied to Syrian nation-state actors but the SEA hasn't ceased activity: it's altered tactics and is now delivering custom Android malware to opponents of the Assad regime for the purposes of surveillance. https://blog.lookout.com/nation-state-mobile-malware-targets-syrians-with-covid-19-lures https://www.zdnet.com/article/these-hackers-are-using-android-surveillance-malware-to-target-opponents-of-the-syrian-government/ the group has seemingly kept a low profile which recently started using the novel coronavirus as its newest lure to entice its targets to download malware.

Introduction

The Syrian Electronic Army (SEA) is a group of computer hackers which first surfaced online in 2011 to support the government of Syrian President Bashar al-Assad. Using spamming, website defacement, malware, phishing, and denial of service attacks, it has targeted political opposition groups, western news organizations, human rights groups and websites that are seemingly neutral to the Syrian conflict. It has also hacked government websites in the Middle East and Europe, as well as US defense contractors. As of 2011 the SEA has been the first Arab country to have a public Internet Army hosted on its national networks to openly launch cyber attacks on its enemies. The precise nature of SEA’s relationship with the Syrian government has changed over time and is unclear

Activities and Tactics

Targeted Sectors: Country, Defense, Opposition, Political party, News - Media, Government, Administration

Country of Origin: 🏳️ Syria

Risk Level: High

Notable Campaigns

  • 2016 Mid
  • 2018-01
  • In recent years
  • Lookout researchers have uncovered a long-running surveillance campaign tied to Syrian nation-state actors
  • but the SEA hasn’t ceased activity: it’s altered tactics and is now delivering custom Android malware to opponents of the Assad regime for the purposes of surveillance.
  • https://blog.lookout.com/nation-state-mobile-malware-targets-syrians-with-covid-19-lures
  • https://www.zdnet.com/article/these-hackers-are-using-android-surveillance-malware-to-target-opponents-of-the-syrian-government/
  • the group has seemingly kept a low profile
  • which recently started using the novel coronavirus as its newest lure to entice its targets to download malware.

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • CyberGate
  • Cyber Eye RAT
  • SeANux: Sea Shell (Basic Web Shell):
  • Executer Webshell:
  • AndoServer:
  • SLRat:
  • SandroRAT:
  • SilverHawk:
  • SpyNote RAT:

Attribution and Evidence

Country of Origin: Syria Additional attribution information pending cataloguing.

References

References pending cataloguing.

Recent News

Latest articles from security news feeds mentioning this actor.