Kjw0rm Variant Used in French TV Station Attack: Researchers

The cyberattack conducted by pro-Islamic State hackers against the French TV station TV5Monde appears to have involved a piece of malware known as Kjw0rm, researchers at Blue Coat reported on Thursday.

The attackers managed to take control of the network’s systems and its social media operations. The ISIS-linked threat actors disrupted the station’s 11 channels and abused the company’s social media accounts to post threats and sensitive information, including the personal details of relatives of French soldiers involved in anti-IS operations.

There isn’t a lot of technical information on the attack, but French news website Breaking3zero has obtained some details. According to Breaking3zero, the attackers leveraged a Java vulnerability to deliver a malicious VBScript file that allowed them to take control of the infected devices.

Based on the information provided by Breaking3zero, Blue Coat researchers believe that the malware used by the pro-IS actors is a variant of Kjw0rm, one of the several remote access Trojans (RATs) developed using source code from the notorious Njw0rm (Jenxcus). Njw0rm and njRAT (Bladabindi), which are highly popular among Middle Eastern threat actors, were targeted in an operation initiated by Microsoft back in June 2014.

The Breaking3zero story revealed that the malware used in the TV5Monde attack was created by an individual using the online moniker “Najaf.” Blue Coat researchers say the code in the Najaf variant is similar to the code of regular Kjw0rm variants. “Most differences revolve around how hardcoded parameters are placed in the code,” Snorre Fagerland, senior principal security researcher at Blue Coat, said in a blog post.

Once it infects a device, the RAT collects information on the system and sends it back to the attackers. The attackers can then launch various commands to download files from a specified URL, execute files, execute shell commands, open websites, shutdown or restart the computer, and launch a ping flood attack against a specified target.

Attribution is a difficult matter. However, evidence uncovered by experts suggests that Najaf is an individual located in Iraq. It’s worth noting that Syria and Iraq are countries where Islamic State militants have occupied a lot of territory. A US-led military coalition that includes France has carried out airstrikes against the jihadist group in these regions.

TV5Monde boss Yves Bigot said the cyberattack, which he believes is “unprecedented in the history of television,” required weeks of preparation. Bigot has pointed out that his company has advanced IT security systems in place.

However, as an interview given on Thursday by TV5Monde journalist David Delos shows, the TV station’s employees are not very conscientious when it comes to security. The interview was filmed in front of a board that contained several passwords. A Belgium-based ethical hacker has managed to read the password for TV5Monde’s YouTube channel off of it.

In an alert issued earlier this week, the FBI warned that individuals supporting ISIS have been defacing websites by exploiting WordPress vulnerabilities.

“The defacements have affected Web site operations and the communication platforms of news organizations, commercial entities, religious institutions, federal/state/local governments, foreign governments, and a variety of other domestic and international Web sites,” the FBI said. Although the defacements demonstrate low-level hacking sophistication, they are disruptive and often costly in terms of lost business revenue and expenditures on technical services to repair infected computer systems.”