‘Witchetty’ Group Targeted Middle Eastern Gov, Stock Exchange of African Nation

A cyber-espionage group is targeting the governments of several Middle Eastern countries and has previously attacked an African country’s stock exchange, stealing massive amounts of data with malware. 

The Symantec Threat Hunter Team named the espionage group “Witchetty” in a report published Thursday, but it has also been known as “LookingFrog.” Witchetty attacks are distinguished by the use of two pieces of malware: X4 and a second-stage payload known as LookBack. 

“From what we can see, their end goal is classic espionage, finding computers on the network, stealing data and exfiltrating it out of the organization,” said Dick O’Brien, a member of the Symantec Threat Hunter team.

In recent months, the group has been updating its tools to use steganography, a technique in which hackers hide malicious code within an image. In Witchetty’s case, the malware is disguised as a Microsoft Windows logo.