Operation Parliament — APT Profile
Operation Parliament is the name Kaspersky gave to an espionage campaign it documented in April 2018, having traced spear-phishing aimed at political figures across the Middle East and North Africa back to early 2017. The vendor's victim tally ran past 130 organizations: seven senates or parliaments, around twenty ministries and diplomatic or other government offices, five military and intelligence bodies, five banks, two media outlets, two sports federations, and a long tail that stayed unclassified. Those targets sat in 27 countries, concentrated in Palestine, Egypt, Jordan, the UAE, Saudi Arabia, Qatar, Lebanon, Iraq, Syria, Iran and Israel but reaching as far as Chile, Canada, the United States, Germany, India, South Korea and Denmark. Ministries covering telecommunications, health, energy, justice and finance all appeared in the victim set, and compromised hosts ranged from ordinary desktops up to domain controllers. Kaspersky described a deliberately modest implant that handed operators a remote command shell and PowerShell access, with configuration and traffic obscured using 3DES and Base64. The company assessed the operators as a previously undocumented actor that borrowed decoys and file naming from Gaza Cybergang to poison attribution, and noted attacks decreasing from the beginning of 2018; no sponsoring state has been publicly established since.
Vendor research
Countries linked to this actor
Read the full analysis on IntelFusions