LONDON — A botched cyberattack aimed at unmasking Syrian dissidents has experts worried that the Islamic State group is adding malicious software to its arsenal.
Internet watchdog Citizen Lab says an attempt to hack into systems operated by dissidents within the self-styled caliphate could be the work of hackers affiliated with the Islamic State group.
Citizen Lab analyst John Scott-Railton said there is circumstantial evidence of the group's involvement, and cautioned that if the group has moved into cyberespionage, "the targets might not stop with the borders of Syria."
The Nov. 24 attack came in the form of a booby-trapped email sent to an activist collective in Raqqa, Syria, that documents human rights abuses in the Islamic State group's de-facto capital. The activist at the receiving end of the email wasn't fooled and forwarded the message to Bahaa Nasr of Cyber Arabs, a project which provides online security training.
"We are wanted — even just as corpses," the activist, whose name is being withheld to protect his safety, told Nasr. "This email has a virus; we want to know the source."
The message eventually found its way to Citizen Lab, based at the University of Toronto's Munk School of Global Affairs. There, Scott-Railton and malware researcher Seth Hardy determined that it could act as a kind of electronic homing beacon by revealing a victim's Internet Protocol address.
Citizen Lab regularly dissects rogue programs from the region, but Scott-Railton said this sample was different from previous attacks blamed on the Syrian government.
"We think we are looking at a different actor," he said — an opinion echoed by malware scientist Thoufique Haq at California-based FireEye, who wasn't involved in the report.
