Security experts outside TrapX said that it was possible
that the attackers had faked the Internet Protocol address in the attack, and that Iran’s hackers had simply grabbed the Russian hacking tool off the web and customized it for their attack.
“This is the very first time we’ve cataloged an attack where Iranian hackers are working with Russian hackers-for-hire,” Carl Wright, an executive at TrapX, the Silicon Valley security firm
that interdicted the hackers last month, said in an interview last week.
Web Defenders Detect Russian Hand in Iranians’ Hacking Attempt -
By NICOLE PERLROTHMAY 15, 2017
For 18 days last month, a team of computer security experts found themselves engaged in a digital version of
hand-to-hand combat with a group of hackers determined to break into the network of a military contractor.
The security researchers found OilRig code used in previous attacks, combined with a type of malware called BlackEnergy
that was used in an assortment of attacks, including the 2015 effort by Russian hackers that took out parts of Ukraine’s power grid.
But the intrusion represented a “historic” partnership between Iran’s hackers
and Russians who are auctioning their skills and tools to the highest bidder, said Tom Kellermann, a computer security expert who previously served as the chief cybersecurity officer at Trend Micro, the Tokyo-based security giant, and was a member of a commission advising the Obama administration on online security.
Security experts said the Iran’s OilRig hackers had become easy to spot over the course
of hundreds of attacks on contractors, energy companies and government agencies.