On January 14, Azerbaijan Internet Watch reported a mass phishing attack that lasted for about a week. At the time of the report, it was possible to identify that the attacks were coming from an IP registered to the Ministry of the Interior. Almost a month later, the Qurium media foundation continues its investigation into the identity of the perpetrator.
The user @man474019 is active on hacking forums anti chat and rdot, as well as on nulled – forum used by cybercriminals to trade and purchase leaked or hacked information.
The last time our man was on antichat was February 17, 2020, likely deleting some of the remaining posts and information.
There are only four entries left on antichat that are visible – can you spot the difference between his current profile and what was there before?
Our man has also removed his avatar. In an earlier report, the man in the photo was identified as Alibay Mammadov. Unfortunately attempts to reach out to Mammadov for a comment failed.
Man must have noticed the reports. And although he may have been busy removing traces, they have already been well documented.
As we were expecting 🧐sandman4812av to delete his github account once the forensic report was released we made a backup copy.
Do not miss his interactions with Technowlogy-Pushpender/technowlogger https://t.co/OR9VTxyreu
On January 6, veteran human rights lawyer Intigam Aliyev received an email from another human rights lawyer Rasul Jafarov. Aliyev, spotted something was not right and forwarded the email he received to Javarov’s real email. This is not the first time, Jafarov is targeted. In 2017, the case was captured in detail by Amnesty International. Unlike Jafarov’s first experience, this time, the email was sent only to a handful of people (at least from what Jafarov was able to collect).
Based on the contents of the phishing email, together with Qurium , it was possible to identify the following information:
malware inside the WeTransfer link is written in python and compiled for windows;
the malware has been built using a software called technowlogger (more here);
The malware records keystrokes, passwords and sends them to a Gmail account after deactivating the antivirus program on your device;
In their forensic investigation, Qurium team was able to identify the email address: man474019 [ @ ] gmail.com. This user, has expressed interest in pen-testing tools, penetration testing and other forms of attacks in hacking forums. Including one attack against criminal.az (website currently blocked and it’s editor facing criminal prosecution).
The picture in the avatar displayed belongs to Alibay Mammadov. Together with Qurium, Azerbaijan Internet Watch suspects the attacker has stolen the identity of Mammadov.
According to this TEDx bio, Alibay Mammadov is based in Japan. He is the head of the Azerbaijan Japan Collaboration Association founded in Tokyo in 2016. The association aims to promote bilateral business relations between Japan and Azerbaijan. He is also the President of Azepro Co., Ltd. Azerbaijan Internet Watch has reached out to Mammadov, warning him of the situation however received no response in return.
The attacker seems to continue his research, as his most recent appearance in the forum was on January 14, 2020:
This, however, was not the last phishing attack.
On January 10, an independent online news platform HamamTimes was targeted with a similar phishing attack. The email came through a Gmail account that belongs to journalist Aziz Karimov.
A similar phishing attack was carried out against Azadliq Radio, Azerbaijan Service for Radio Free Europe Radio Liberty team.
On January 11, a larger group of civil society representatives received another WeTransfer link from Roberto Fasino. Fasino is the Head of the Secretariat, PACE Committee on Culture, Science, Education, and Media.
WeTransfer does not verify emails for validity when inserted in the sender or recipient box – you can insert anyone’s email. As a result, any email can be used, including that of Roberto Fasino in the sender box [see below].
According to Qurium forensics, the virus sent to HamamTimes and from Roberto Fasino is “powershell” exploit that can gain full access to a windows machine. It connects to an intermediary server where the attacker can connect to control the victim’s device. This is how the attack looks when broken down into steps:
The attacker prepared the “powershell” attack;
Obfuscate the code using HTML Guardian (HTA file);
Upload the file to We-transfer and mail to several victims [how the contact list has been obtained is still unclear – one scenario is that the sender’s email, in this case, roberto.fasino@coe.int was compromised;
Once the victim’s device is infected the attacker then continues to perform the attack performing “Reflective DLL” injection into the infected device and uploads the “merterpreter” code;
The final step, allows the attacker to have full access to a victim’s device, running commands remotely;
The forensics report also identified that the attacker has set up an account in ngrok.com service to hide his computer.
Once the virus is inside the infected device, it connects to the ngrok.com address 3.17.202.129 and port number 16885.
So far, attempts to reach ngrok.com founder Alan Shreve for a comment and assistance yield no results:
On January 14, new evidence showed the attacker was also using Facebook messenger to infect devices. The new evidence, as well as further investigations of the IP address of the attacker, revealed man474019 to be connected to the government of Azerbaijan and that this was the same location from where DDoS attacks against several independent and opposition websites were coordinated in 2017. The new report also shows that this network includes several ministries, as well as the presence of several firewalls with digital certificates signed by the national cert (cert.az)
Orkhan Shabanov, whose name and email appear in Hacking Team leaks indicated in Qurium’s report, is an employee at the Ministry of the Interior. In his capacity, Shabanov was among participants at the Open-ended intergovernmental expert group meeting to conduct a comprehensive study of the problem of cybercrime that took place in Vienna in March 2019.
What is phishing:
It is when you receive an email from someone who pretends to be someone you know, and phishes for your private information by asking you to download the attachment, or click on a link that would take you to a different page where you are prompted to enter some of your personal sensitive information, including passwords.
In 2019, Amnesty Tech released a detailed report on common phishing attacks used against journalists and rights defenders in MENA. Many of these conclusions apply to other countries as well.
The report describes the following most common types of phishing attempts:
“Reset your password” email – attacker impersonating Google alerts the owner of the account of an alleged unsuccessful login attempt. It then offers to secure the account. Once clicked on the provided link, it redirects you to a page that may look like your Gmail login page, but in fact, it is a fake;
“OAuth Phishing” – is a Web standard used to allow authentication over third-party services without the need of sharing passwords. It is used by companies like Google, Facebook, and Microsoft. According to Amnesty report, this type of phishing allows “attackers use the same architecture but in order to create malicious third-party applications and attempt to lure the targets into granting the applications access to their accounts (such as emails)”;
Google phishing abusing legitimate third-party applications – using the method, attackers abuse the authentication procedure employed by legitimate and verified third-party applications;
This post is based on the research of Azerbaijan Internet Watch and Qurium Media Foundation. A full forensic report by Quriu is available here.
Since the release of this and Qurium’s forensic report, man474019 seem to have removed some of the information from https://forum.antichat.ru/
You can see the difference from how the user profile looks now and from Wayback machine capture (July 2019). The picture is gone too.
How profile looks now.How profile looked July 2019
Anar Mammadov is editor of criminal.az – website that was blocked by the authorities in Azerbaijan in 2018. Mammadov was sentenced to 5.5 years of imprisonment with a two-year probation period on charges of anti-state appeals, abuse of power and official forgery in March 2019. The official cause of the criminal prosecution was the publication of news about the assassination attempt on the former head of the city of Ganja Elmar Veliyev.
On January 6, Mammadov was pressed with a set of new allegations facing arrest. The accusation comes from a woman, named Malahat Gurbanova. Mammadov wrote about Gurbanova’s legal battle with former Minister of Social Services earlier on. Gurbanova now, alleges Mammadov’s language used to describe Gurbanova in his coverage was slanderous and insulting. Mammadov refutes these claims in his defense adding, if anything, it is he who feels insulted.
Criminal.az is an independent website covering predominantly crime-related stories. The website was blocked by the authorities in 2017, along with a number of other critical and independent news websites. It later began operating under the criminalaz.com domain, which was also blocked shortly after.
*Criminalaz.com, Fia.az, bastainfo.az and topxeber.az were blocked in Azerbaijan after the prosecutor’s office claimed these news websites misinformed their audiences and shared news of provocative nature that were untrue. [Turan News Agency]
**Since May 2017, over 20 websites have been blocked in Azerbaijan, among them: Azadliq Radio (Radio Free Europe/Radio Liberty Azerbaijan Service) and its international service, Radio Free Europe Radio Liberty, Azadliq Newspaper (independent of the Azadliq radio), Meydan TV, Turan TV and Azerbaijan Saadi (Azerbaijan Hour), OCCRP (Organized Crime and Corruption Reporting Unit), abzas.net, obyektiv.tv, and others on the ground these outlets promoted violence, hatred, extremism, violated privacy or constituted slander.
***Websites blocked since then are blocked for slander and spreading misinformation. At some point, an editor of the blocked az24saat.org was asked to remove four articles that mentioned Ali Hasanov, now a former aide to President Ilham Aliyev. Monitortv.info, which was among the blocked websites, also received a note requesting the removal of articles mentioning Ali Hasanov on the grounds these stories contained slander and lies. [Open Democracy]
At the time of the verdict against the journalist Mammadov, several international journalism organizations, and the OSCE Representative on Freedom of the Media criticized the court’s decision.
The New York-based Committee to Protect Journalists called on the Azerbaijani authorities to drop charges against Mammadov and pointing to the unfounded prosecution.
“Informing the general public about important events is what journalists do, and the authorities should support this work, and not punish reporters,” said Gulnoza Said, CPJ Program Coordinator for Europe and Central Asia.
In June 2019, the Baku Court of Appeal upheld the conviction of Anar Mammadov.
Timeline
15 May 2019 – Mammadov summoned to the prosecutor’s office. This time the journalist was questioned over a story about the state oil company – SOCAR.
Meydan TV, an independent online news website covering Azerbaijan was also targeted. Although the website of Meydan.tv was blocked already in 2017, following the publication of stories about SOCAR, the website was heavily DDoSed.
9 July 2018 – Mammadov, questioned by the police. The journalist’s home was searched and his personal devices, including his laptop and phone, were seized by the police.
Mammadov was questioned after publishing reports on an attempt on the life of the mayor of Ganja, Elmar Valiyev, on 3 July.
24 July 2018 – Mammadov was summoned to the prosecutor’s office. The journalist was questioned about the publication of reports on the assassination attempt and was warned not to spread “investigative secrets”.
In a report on Broadband speed released by cable.co.uk Azerbaijan was ranked 141 out of 207 countries. The average speed in Azerbaijan remains around 3-4 Mbps.
Experts say this is a result of multiple factors, such as monopoly over internet providers, high costs and poor quality of internet connectivity across the country.
Worldwide broadband speed league 2019
cable.co.uk
In an interview with Azadliq Radio, Azerbaijan Service for Radio Free Europe, the head of Azerbaijan Internet Forum Osman Gunduz said the issue is a monopoly. “65% of the internet market in Azerbaijan is in the hands of the government providers. The price is regulated not by the market but by the government providers. And when private companies offer lower rates they get pressured in return”, explained Gunduz in an interview.
Media law expert Alasgar Mammadli believes the issue is not just monopoly but the lack of infrastructure and supply. The majority of internet service providers are based in the capital Baku. This has a significant impact on regional supply chains. But even in the capital, there is a lack of good internet speed and connection.
Despite numerous government plans and investments to improve overall ICT infrastructure in Azerbaijan, the country’s internet connection quality is only ahead of its neighboring post-Soviet countries – Turkmenistan, Uzbekistan, Tajikistan, and Kyrgyzstan.
May 2020 bring us all across the world censorship-free internet and for everyone documenting, reporting, monitoring, advocating, and fighting for it, here is to a year full of progress and solidarity in standing together for the good cause.
And with just a few hours (depending on what part of the world you are in) left to mark the new year, here are a few highlights from Azerbaijan as documented by AIW in the last three months:
* The authorities in Azerbaijan continued to deploy information controls against its civil society;
* Countless social media activists were targeted for facebook posts;
* More than 50 independent, and opposition news websites remain blocked;
* Political activists remained under surveillance, as their phone conversations were leaked to pro-government media outlets;
* In one case, the television anchor who leaked the conversation later deleted the whole segment, as the leaked phone call took place between two international diplomats speaking with the political activist;
* One journalist’s conversation on facebook messenger was intercepted and leaked to a news outlet;
* While its size is unknown, the Azerbaijani troll army continued reporting to social media platforms alleged content abusing platforms’ copyright violation rules. in none of the cases that were examined, the reported content was an actual violation;
* An article that was published on OpenDemocracy examined closely how some of this content was taken down;
* Azerbaijan was ranked “not free” by freedom house in its annual freedom on net report for 2019;
“The already poor state of internet freedom in Azerbaijan continued to deteriorate during the coverage period. Access is inhibited by infrastructural challenges—illustrated by a major power outage in July 2018—and by state control over the information and communication technology (ICT) industry. The government manipulates the online information landscape, blocking websites that host unfavorable news coverage and using automated “bot” accounts to spread propaganda. Digital rights are not respected, and those who voice dissent online can expect prosecution if they reside in the country or various forms of intimidation if they live abroad.”
“Power in Azerbaijan’s authoritarian government remains heavily concentrated in the hands of Ilham Aliyev, who has served as president since 2003. Corruption is rampant, and after years of persecution, formal political opposition groups are weak. The regime has overseen an extensive crackdown on civil liberties in recent years, leaving little room for independent expression or activism.”
* In October, during one opposition rally, Azerbaijani citizens reported wide internet connectivity issues; most of the businesses in downtown Baku said the Internet was down throughout the day, which affected the local businesses;
* The national parliament picked up on the earlier discussions on introducing new measures to monitor the Internet in the country but now new developments have taken place since;
AIW will continue monitoring and documenting, internet censorship in Azerbaijan in 2020. Stay tuned and thank you for following!
On December 24, 2019, the administrative-economic court in Baku rejected the claim by arqument.az against Transportation, Communication and High Technologies ministry. Arqument.az took the ministry to court following its decision to block arqument.az inside the country.
The website’s editor Shamshad Agayev intends to appeal the decision.
Arqument.az was blocked on August 8, 2018, following a decision issued by Sabail District Court. A few days later, Baku Court of Appeal annulled district court’s decision.
But arqument.az was blocked once again in April 2019 after publishing coverage of protests in Jalilabad district. The website was also subject to cyber attacks after being blocked.
In its newly released report, Committee to Protect Journalists says the number of imprisoned journalists is a record high.
In total 250 journalists remain behind bars according to a newly updated database. 6 of these journalists are from Azerbaijan.
Other findings from CPJ’s annual census include:
Ninety-eight percent of journalists jailed worldwide are locals covering their own country. Three of the four journalists with foreign citizenship are imprisoned in Saudi Arabia, and the fourth in China.
Twenty of the jailed journalists, or 8%, are female, compared with 13% last year.
Politics was the beat most likely to land journalists in jail, followed by human rights and corruption.
More than half of those imprisoned were reporters publishing online.
On November 5, Freedom House released the new edition of Freedom on the Net report. The report ranks 65 countries.
According to 2019 Freedom on the Net report, Azerbaijan was downgraded to “not free” scoring 39 out of 100.
The already poor state of internet freedom in Azerbaijan continued to deteriorate during the coverage period. Access is inhibited by infrastructural challenges—illustrated by a major power outage in July 2018—and by state control over the information and communication technology (ICT) industry. The government manipulates the online information landscape, blocking websites that host unfavorable news coverage and using automated “bot” accounts to spread propaganda. Digital rights are not respected, and those who voice dissent online can expect prosecution if they reside in the country or various forms of intimidation if they live abroad.
Internet connections were reportedly down Saturday, October 19, 2019.
While no official explanation was provided for the reasons of poor connectivity, civil society activists say authorities cut off the internet connection on purpose to prevent political activists and participants of the opposition rally to share and report updates from the unsanctioned political rally organized in the capital of Baku on October 19.
The rally took place in multiple locations across downtown Baku, as a result, users reported connectivity problems throughout the day, across the center of Baku.
According to reports, in addition to mobile internet connection not working, some landlines and wifi connections across the downtown area were reportedly down.
Elesger Ahmedoglu, a media law expert, wrote on his Facebook, the situation was akin to an emergency. “Mobile operators and internet providers caused damage worth in millions by cutting off mobile internet for hours on end, both to the business owners and public. This is a serious violation of rights and anyone affected, must appeal to courts,” wrote law expert.
Azercell, the country’s biggest telecom company failed to explain why its subscribers did not have access to the Internet on October 16, 2019.
While the company did acknowledge the glitch in the system and said it will address the issue, no further explanations were provided to explain the cause of the problem.
