Campaign
campaign:operation_manul
Also: Manul
Investigation into targeted malware attacks against Kazakhstan-related journalists, activists, and associates.
Investigation into targeted malware attacks against Kazakhstan-related journalists, activists, and associates.
“Operation Manul started when the EFF was representing a woman named Irina Petrushova”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | INVOLVES | Irina Petrushova | Explicit | 38 |
| outgoing | INVOLVES | Respublika | Explicit | 38 |
| outgoing | INITIAL_ACCESS_VIA | spear phishing | Explicit | 38 |
| outgoing | INVOLVES | jRat | Explicit | 38 |
| outgoing | INVOLVES | Bandook | Explicit | 38 |
| outgoing | INVOLVES | command and control server | Explicit | 38 |
| outgoing | ASSOCIATED_WITH | Kazakhstan | Uncertain | 38 |
| outgoing | INVOLVES | Pallas | Attributed | 38 |
Operation Manul INVOLVES Irina Petrushova
Operation Manul began in the context of EFF representing Irina Petrushova, who was targeted after reporting on Kazakhstan's government.
Explicit Confidence 98% · Cooper Quinton EP 38 Details
“Operation Manul started when the EFF was representing a woman named Irina Petrushova”
Operation Manul INVOLVES Respublika
The campaign involved targeting people connected with Respublika and its reporting.
Explicit Confidence 95% · Cooper Quinton EP 38 Details
“the people who were going after Respublika and after Irina Petrushova”
Operation Manul INITIAL_ACCESS_VIA spear phishing
The campaign initially targeted Irina, her brother, and associates with spear-phishing emails carrying malicious attachments.
Explicit Confidence 99% · Cooper Quinton EP 38 Details
“she and her brother who is also an editor started receiving spear phishing e-mails”
Operation Manul INVOLVES jRat
Malicious attachments used in the campaign downloaded jRat.
Explicit Confidence 99% · Jack Rhysider EP 38 Details
“when you open these attachments it will go download a piece of malware called jRat.”
Operation Manul INVOLVES Bandook
The campaign also used Bandook as a second piece of malware.
Explicit Confidence 99% · Jack Rhysider EP 38 Details
“a second piece of malware which also was discovered called Bandook.”
Operation Manul INVOLVES command and control server
The campaign used command-and-control servers to communicate with the malware and receive stolen files.
Explicit Confidence 99% · Cooper Quinton EP 38 Details
“We started looking into the malware and we find the command and control servers.”
Operation Manul ASSOCIATED_WITH Kazakhstan
The researchers believed the people targeting Respublika and Irina were likely acting on behalf of Kazakhstan, but described the evidence as circumstantial.
Uncertain Confidence 88% · Cooper Quinton EP 38 Details
“were likely doing this on behalf of the government of Kazakhstan”
“we have a pretty good link to Kazakhstan although no – it’s all circumstantial evidence.”
Operation Manul INVOLVES Pallas
Lookout found mobile malware communicating with domains associated with Operation Manul and believed it was related to the campaign.
Attributed Confidence 95% · Cooper Quinton EP 38 Details
“We think that it’s related to Operation Manul.”