Operation Electric Powder

Also known as: Operation Electric Powder

(ClearSky) From April 2016 until at least February 2017, attackers have been spreading malware via fake Facebook profiles and pages, breached websites, self-hosted and cloud based websites. Various artifacts indicate that the main target of this campaign is IEC – Israel Electric Company. These include domains, file names, Java package names, and Facebook activity. We dubbed this campaign “Operation Electric Powder“. Israel Electric Company (also known as Israel Electric Corporation) “is the largest supplier of electrical power in Israel. The IEC builds, maintains, and operates power generation stations, sub-stations, as well as transmission and distribution networks. The company is the sole integrated electric utility in the State of Israel. It installed generating capacity represents about 75% of the total electricity production capacity in the country.” It is notable that the operational level and the technological sophistication of the attackers are not high. Also, they are having hard time preparing decoy documents and websites in Hebrew and English. Therefore, in most cases a vigilant target should be able to notice the attack and avoid infection. We do not have indication that the attacks succeeded in infecting IEC related computers or stealing information. Currently we do not know who is behind Operation Electric Powder or what its objectives are. Also see ‘WildCard’. This actor is reported as potentially linked to the threat actor known as ‘Molerats, Extreme Jackal, Gaza Cybergang’, but no strong evidence has been found.

🌍 Country ["[Unknown]"]
📅 Activity 2017 — 2017
2017
2017

Introduction

(ClearSky) From April 2016 until at least February 2017, attackers have been spreading malware via fake Facebook profiles and pages, breached websites, self-hosted and cloud based websites. Various artifacts indicate that the main target of this campaign is IEC – Israel Electric Company. These include domains, file names, Java package names, and Facebook activity. We dubbed this campaign “Operation Electric Powder“. Israel Electric Company (also known as Israel Electric Corporation) “is the largest supplier of electrical power in Israel. The IEC builds, maintains, and operates power generation stations, sub-stations, as well as transmission and distribution networks. The company is the sole integrated electric utility in the State of Israel. It installed generating capacity represents about 75% of the total electricity production capacity in the country.” It is notable that the operational level and the technological sophistication of the attackers are not high. Also, they are having hard time preparing decoy documents and websites in Hebrew and English. Therefore, in most cases a vigilant target should be able to notice the attack and avoid infection. We do not have indication that the attacks succeeded in infecting IEC related computers or stealing information. Currently we do not know who is behind Operation Electric Powder or what its objectives are. Also see ‘WildCard’. This actor is reported as potentially linked to the threat actor known as ‘Molerats, Extreme Jackal, Gaza Cybergang’, but no strong evidence has been found.

Activities and Tactics

Country of Origin: 🏳️ [“[Unknown]”]

First Seen: 2017

Last Activity: 2017

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 1 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

  • SysJoker
  • SysJoker:

Attribution and Evidence

Country of Origin: [“[Unknown]”] Additional attribution information pending cataloguing.

References

References pending cataloguing.