Iranian Protests: Propaganda War

Wapack Labs is monitoring the developments in the ongoing Iran protests. Wapack analysts continue to observe an increase in Internet restriction and disabling of communication applications; Facebook, Twitter, Telegram, Google, WhatsApp, and Signal. To date, ProtonMail’s free VPN service for Android phones, and Psiphon, an app that circumnavigates network firewalls, are the only means of providing anonymity for Iranian citizens. As information censorship increases, so too does pro-regime propaganda. The current climate in Iran may give way to Iranian-backed threat actors targeting the anti-regime demonstrators. Wapack Labs assesses, with moderate confidence, that the cyber activity will remain confined to Iran, but continues to monitor the situation for movement affecting our customer base...READ MORE

Wapack Labs has cataloged and reported on protests and cyber activity in Iran in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

Iranian Protests: Communication Bans & Targeting of Protestors

Wapack Labs has been monitoring the developing Iran protests. By Day 9, Wapack analysts observed an uptick in Internet and communication restrictions, including social media platforms, phone applications, encrypted/secure messaging, and Virtual Private Network (VPN) services, and other platforms. Formerly accepted by the Iranian government, the Instant Messaging Service ‘Telegram’, which had tremendous activity on Day 2 of the protests, is now disabled. At the moment, Google is preventing Iranians from using the Google Search Engine and from using ‘Signal’, an end-to-end encryption messenger that circumnavigates government filtering. To date, ProtonMail’s free VPN service for Android phones, is the only means of providing anonymity for Iranian citizens. As the Iranian government continues to disrupt communications, they are implementing scare tactics to persuade protestors to stop the movement. Irancell, a mobile network service provider, is tracking down its users - who have posted videos and pictures online - and sending them text notifications, warning them that they have been participating in illegal protests. Additionally, the Twitter account of the Tasnim News Agency (@Tasnimnews_Fa) is posting pictures of protestors, asking followers to identify protestors and report them to Iranian security forces. The current climate in Iran may give way to another wave of Iranian cyber hacktivists targeting the anti-regime demonstrators...READ MORE

Wapack Labs has cataloged and reported on Iranian protests and communications in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

8chan Vs. Anonymous

On 4 October 2017, Wapack Analysts observed a post made to 8chan’s image board with a link to a raid against Anonymous on the "insurgency" board. Raids are commonly organized on image boards and are the act of harassing an organization by means of exposing one’s personal information (doxing), SWATing, hacking, spamming, prank phone calling, and other forms of remote harassment. The raid organizers claim that they are sick of the Anonymous movement and that hacktivists are a bunch of annoying Social Justice Warriors (SJW). The term SJW is very common derogatory slang among image board users, directed at individuals who fight strongly for a cause. Several doxes of Anonymous members have been posted, but still need to be verified. Alternative communication sources for the raid, such as IRC and Discord, were once active, but currently are not. The raid started in June and is still active on 8chan’s "insurgency" board, but alternative communication sources are no longer active, suggesting the raid is dying down in popularity and will likely soon end. Wapack Labs Analysts will continue to monitor 8chan’s cyber operations, conducted against Anonymous, for any potential implications to our subscribers...READ MORE

Wapack Labs has cataloged and reported image boards and activity involving Anonymous in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

Morocco: Business in Sub-Saharan Africa

Morocco has recently initiated the Octopus Development Plan: an economic strategy designed to better assist Senegal.  Experts believe the underlying purpose for this plan is to further link banking and communication industries under Morocco and the United Arab Emirates (UAE) conglomerates.  The ability to control, disrupt or influence banking and communications on these networks by extremists or radicals is a major concern.  This information is being supplied for your situational awareness.

• Morocco is a major investor and developer in the banking and telecommunications industries in Africa.

• The Octopus Development Plan will further expand their interests in banking and communication is Western Africa.

• The United Arab Emirates and Morocco own controlling interests in the banking and communications industries in Northern, Western, and Sub Saharan Africa.

Publication Date:                    14 November 2016

Handling Requirements:        Traffic light protocol (TLP) GREEN

Attribution/Threat Actors:     Unknown

Actor Type:                              Adversary capabilities have been assessed as Tier II*

Potential Targets:                    Morocco, West Africa and Sub Saharan Africa

Past Reporting:                        DOC-4360, DOC-4423

* Practitioners with a greater depth of experience, with the ability to develop their own tools (from publicly known vulnerabilities).


The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.

Mauritania: Recent E-mail Scam Exposes Weaknesses

Mauritania, specifically their capital Nouakchott, face numerous cyber challenges to their banking/corporate, government and personal communications due to outside dependence on network infrastructure.  A recent cyber-attack directed towards their Communication Director and his staff demonstrate this vulnerability.  Simple cyber-attacks as this, illustrate weaknesses to many developing African nations; and in reality, many developing nations.  This information is being supplied for your situational awareness.

• Mauritania and West Africa must rely on outside network providers which present many vulnerabilities.

• Developing nations face many basic cyber security related challenges.

• Heightened cyber security education, training and experience is desired for many developing nations.

Publication date:                            21 October 2016

Handling requirements:                  Traffic light protocol (TLP) GREEN

Attribution/Threat Actors:              Stranded Traveler actors

Actor Type:                                     Adversary capabilities have been assessed as Tier II*

Potential Targets:                           Mauritania and neighboring West African nations

Past Reporting:                               Red Sky Alliance: DOC-4365

*Practitioners with a greater depth of experience, with the ability to develop their own tools (from publicly known vulnerabilities).

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.