News media websites attacked from Governmental Infrastructure in Azerbaijan

10 February 2017

Ministry of Communications and High Technologies (Azerbaijan).

10 March 2017, 00:01 UTC

Forensic evidence collected by VirtualRoad.org during the past six months shows how a dedicated group of cyber attackers is actively engaged in denial-of-service attacks, intrusion attempts, spear-phishing campaigns and electronic media monitoring from Internet infrastructure associated to the Government of Azerbaijan.

This report summarizes our findings that result from our efforts to repeal and track the attacks. In January 2017, after tens of denial of service and penetration attempts, the same group started to use the same infrastructure used by “AutoItSpy” , a home-grown malware designed to spy and collect information from targeted human rights activists. These overlaps of malicious activities can hardly be explained without considering the existence of a campaign designed to target dissenting voices in the country.

Denial of service attacks against independent media

An example of such cyberattacks took place the 12th of January 2017, when the website www.abzas.net started to receive a serie of application layer denial-of-services attacks that lasted for eight days. During five full consecutive days the website remained inaccessible until it was finally migrated to VirtualRoad.org’s secure hosting infrastructure.

Our forensic investigation links the attackers of the news’ site abzas.net with other security events that we have been monitoring for the past six months. The attackers that targeted Abzas.net, have also been active against other media websites from Azerbaijan including cumhuriyyet.net and azadliq.info.

The attackers, which used compromised servers, the Tor network infrastructure and “Zenmate” VPN services to orchestrate the traffic floodings, left digital traces that link them with the IP Network 85.132.24.0/24, and more specifically the IP addresses 85.132.24.74 and 85.132.24.77.

In the same IP network, we can find several Azerbaijani governmental services, such as the Ministry of Foreign Affairs (tourvisa.mfa.gov.az @85.132.24.246), the mailserver of the Cabinet of Ministers (mail.cabmin.gov.az @85.132.24.82), and the mailserver of the Ministry of Transport (mail.mot.gov.az @85.132.24.51).

The most probable location of the attacker(s) is the premises of the Ministry of Transport (in Tbilisi Avenue No #1054, Baku, Azerbaijan) since the “non-automated attacks” always take place during office hours. During the writing of this report, we have been informed that on the 13th February 2017, the Ministry of Transport was merged with the High Technologies to form the new Ministry of Transport, Communications and High Technologies.

As a reaction to our attempts to block the denial of service attacks, the source IP address 85.132.24.74, was changed to 85.132.24.77 . Apart from attacking media sites, the same addresses are also used to provide access to the public Internet at the Ministry of Transport, from where legitimate readers visit the websites on a daily basis.

Also in January 2017, a very distinctive attack was launched against Abzas.net and Azadliq.info. Eleven dedicated servers, all closely connected with system administrators in Azerbaijan, were abused to launch a denial-of-service attack against these media sites. One of the servers used in the attack, with IP address 136.243.173.205, hosts the website Hackaton Azerbaijan.

The site is hosted with Yer.az, a hosting company owned by Rashad Aliyev, a security professional with close ties to Governmental-endorsed cyber-security activities. When we confronted Rashad Aliyev about the attacks and the compromised servers, he acknowledged that the traffic floods were sourced from his server, but argued that due to privacy reasons, he was not able to provide more details about the attacks or who might be behind them.

Monitoring and tracking of news sites

During our review of suspicious traffic patterns we also identified what seems to be a “customized service” that monitors and tracks multiple news sites in Azerbaijan. Such service was monitoring news sites every 15minutes. Most likely, this monitoring system was used to evaluate the success (or failure) of denial-of-services attacks, as they could track when a site become unreachable, and for how long it lasted.

Since VirtualRoad.org hosts several of the targeted sites including Azadliq.info, we decided to block the monitoring system. To avoid our blocking, the attackers changed IP address of their system several times. However, in the morning of the 6th of January 2017, after several failed attempts to re-activate their monitoring system, the attackers decided to move the operations to a new IP address, namely 85.132.78.164.

IP address 85.132.78.164 – the connection with malware “AutoItSpy”

During the review of the malicious activity associated with this specific address, we found several malware samples of what seemed a “homegrown spyware” ex-filtrating data to the same location. Our findings overlap with the report of Amnesty International researchers about a malware dubbed “AutoItSpy”.

Our analysis of the malicious code also reveals that the attackers were collecting screen shots and logging key strokes from the victims’ computers and submitted them to a server hosted at IP address 85.132.78.164.

Appendix – Forensic data

Below follows forensic data collected for the denial-of-service attacks, the system monitoring and the targeted malware campaign.

DDoS attacks

Dedicated Azerbaijani administrated servers used to launch DDoS attacks

One interesting aspect of the DDoS attacks is the nature of the dedicated servers that were used to launch them. In most cases, attackers compromise random websites to place persistent backdoors and the attack generation code that assist them to run web requests floods while remaining untraceable. To our surprise, the attackers placed the malicious code in dedicated servers operated by other Azeri system administrators. This finding make us believe that the attackers are close to the cybersecurity community in Azerbaijan.

CB-Prx Web Flooder from compromised site

One of the servers used for the attack hosted the website for the “Hackathon in Azerbaijan”

Faik Farmanov (IntraNS, TLD .az), Rashad Aliyev (Yer.az) at Hackathon Azerbaijan

Not novel attack code

The attack code used to launch the DDOS is written in PHP and it is a modified version of Punker2Bot PHP Flooder. A old script is available here

    $header = "GET ".$ruta." HTTP/1.1\r\n";
    $header .= "Host: ".$dominio."\r\n";
    $header .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.8.1.16) Gecko/20080702 Firefox/2.0.0.16\r\n";
    $header .= "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,image/jpg,image/gif,*/*;q=0.5\r\n";
    $header .= "Accept-Language: es-es,es;q=0.8,en-us;q=0.5,en;q=0.3\r\n";
    $header .= "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n";
    $header .= "Keep-Alive: 310\r\n";
    $header .= "Proxy-Connection: keep-alive\r\n";
    $header .= "Referer: http://".$dominio.$ruta."\r\n";
    $header .= "Content-Type: application/x-www-form-urlencoded\r\n";
    $header .= "X-Forwarded-For: ".$ip_simulada."\r\n";
    $header .= "Via: CB-Prx\r\n";
    $header .= "Connection: Close\r\n\r\n";