"value":"This report describes a campaign of targeted spyware attacks carried out by a sophisticated operator, which we call Stealth Falcon. The attacks have been conducted from 2012 until the present, against Emirati journalists, activists, and dissidents. We discovered this campaign when an individual purporting to be from an apparently fictitious organization called \u00e2\u20ac\u0153The Right to Fight\u00e2\u20ac\u009d contacted Rori Donaghy. Donaghy, a UK-based journalist and founder of the Emirates Center for Human Rights, received a spyware-laden email in November 2015, purporting to offer him a position on a human rights panel. Donaghy has written critically of the United Arab Emirates (UAE) government in the past,1 and had recently published a series of articles based on leaked emails involving members of the UAE government.2\r\n\r\nCircumstantial evidence suggests a link between Stealth Falcon and the UAE government. We traced digital artifacts used in this campaign to links sent from an activist\u00e2\u20ac\u2122s Twitter account in December 2012, a period when it appears to have been under government control. We also identified other bait content employed by this threat actor. We found 31 public tweets sent by Stealth Falcon, 30 of which were directly targeted at one of 27 victims. Of the 27 targets, 24 were obviously linked to the UAE, based on their profile information (e.g., photos, \u00e2\u20ac\u0153UAE\u00e2\u20ac\u009d in account name, location), and at least six targets appeared to be operated by people who were arrested, sought for arrest, or convicted in absentia by the UAE government, in relation to their Twitter activity.\r\n\r\nThe attack on Donaghy \u00e2\u20ac\u201d and the Twitter attacks \u00e2\u20ac\u201d involved a malicious URL shortening site. When a user clicks on a URL shortened by Stealth Falcon operators, the site profiles the software on a user\u00e2\u20ac\u2122s computer, perhaps for future exploitation, before redirecting the user to a benign website containing bait content. We queried the URL shortener with every possible short URL, and identified 402 instances of bait content which we believe were sent by Stealth Falcon, 73% of which obviously referenced UAE issues. Of these URLs, only the one sent to Donaghy definitively contained spyware. However, we were able to trace the spyware Donaghy received to a network of 67 active command and control (C2) servers, suggesting broader use of the spyware, perhaps by the same or other operators."
},
{
"category":"Payload delivery",
"comment":"Fake invitation",
"deleted":false,
"disable_correlation":false,
"timestamp":"1464614633",
"to_ids":true,
"type":"email-src",
"uuid":"574c3ee9-93c4-4421-abcb-493f950d210f",
"value":"the_right_to_fight@openmailbox.org"
},
{
"category":"Payload delivery",
"comment":"loaded a page containing a redirect to the website of Al Jazeera. Before completing the redirect, it invoked JavaScript to profile the target\u00e2\u20ac\u2122s computer.",
"deleted":false,
"disable_correlation":false,
"timestamp":"1464614671",
"to_ids":true,
"type":"url",
"uuid":"574c3f0f-cc04-46b5-8476-0fa1950d210f",
"value":"http://aax.me/d0dde"
},
{
"category":"Payload delivery",
"comment":"",
"deleted":false,
"disable_correlation":false,
"timestamp":"1464614693",
"to_ids":true,
"type":"url",
"uuid":"574c3f25-2208-4d70-b8cf-4d45950d210f",
"value":"http://aax.me/a6faa"
},
{
"category":"Payload delivery",
"comment":"This is a password-protected link to a file shared on an ownCloud15 instance. We obtained this file, and found it to be a Microsoft Word document.",
"comment":"The document\u00e2\u20ac\u2122s macro was identical to the one sent to Donaghy, except it reported back to, and downloaded Stage Two from a different URL",
"comment":"The document\u00e2\u20ac\u2122s macro was identical to the one sent to Donaghy, except it reported back to, and downloaded Stage Two from a different URL",
"deleted":false,
"disable_correlation":false,
"timestamp":"1464615408",
"to_ids":true,
"type":"domain",
"uuid":"574c41f0-833c-4fe2-8e1e-0fa3950d210f",
"value":"optimizedimghosting.com"
},
{
"category":"Network activity",
"comment":"The Stage Two in this case reported back to",
