Military data are mostly classified because they may contain strategies, information about equipment and espionage a government holds.
But according to a report by researchers at cybersecurity firm ESET, hackers somehow managed to steal quite a lot of sensitive information from the Venezuelan military forces.
Using 'Machete', the cyber espionage toolset developed by a Spanish-speaking group that has been operating since at least 2010, the hackers managed to steal gigabytes worth of data.
According to the researchers:
Machete has been active since at least 2010, with hackers continuously improving methods in using this malware for attacks.
With focus on Latin American countries, with Machete, hackers managed to collect intelligence data by improvising their tactics over the years, with a majority of the targets being military organizations, said ESET.
First documented by Kaspersky in 2014, Machete that has been observed by ESET, was found to have at least infected at least 50 computers, most of which belonged to the military, with all of them communicating with the malware's command-and-control (C&C) servers between the period March and May 2019.
To lure targets to install the malware, they used spearphishing emails with the malicious files as attachments.
And to make those targets open the emails, the group included several previously stolen classified military documents, including radiograms. They also used some words and terms common in the military to make the emails even more convincing.
Once targets download and open the attachment, the malware quickly infect the targets' system to then create a backdoor, explained ESET.
Coded in Python programming language, the malware consistently spy on the targets and runs indefinitely in the background.
The malware can then copy and encrypt documents, take screenshots, act as a keylogger and so forth. And once every 10 minutes, the malware communicates with its C&C server to upload the stolen data.
And to mask its presence, the malware can take the names with "Google" as prefix.
"The group behind Machete has managed to continue operating even after researchers have published technical descriptions and indicators of compromise for this malware," ESET added.
"It is the targeted organizations, though, who have failed in raising awareness and applying security policies so that employees don’t fall for these attacks in the first place."
