Operation Parliament: sophisticated spies pose as skids. Sinkholing EITest. Facebook testimony wraps. Estonia reports on 2017.

Kapersky describes "Operation Parliament," a wide-ranging cyberespionage campaign that, since early 2017, has cloaked its activities by pretending to be the Gaza Cybergang, a well-known and not well-respected group of skids. The actor behind Operation Parliament appears anything but unsophisticated. The malware it used is still under study, but it does not appear to have any obvious relationship with previously seen attack code. Targets were carefully verified before infection, and Kaspersky says the unidentified operators did "just enough to achieve their goals." Most of the organizations targeted were in the Middle East and North Africa, but infections extended to Europe, South Korea, and North America as well. The campaign has slowed since the beginning of 2018, suggesting the spies got what they came for.

Proofpoint has successfully sinkholed what they call the oldest running infection chain: EITest. They say the campaign, active since 2011, seems to have been "purely criminal" as opposed to state directed. The large network of compromised servers it used (about 51 thousand), and its concealment of  command-and-control infrastructure behind a domain generation algorithm, made EITest unusually resistant to takedown. EITest passed "filtered, high-quality traffic to threat actors operating exploit kits and web-based social engineering schemes."

Facebook's sessions before Congress are over, with House inquisitors getting higher marks from the media than did their Senate counterparts.

Those interested in seeing how a small country punches far, far above its weight in cyberspace will find the Estonian Internal Security Service's newly released Annual Report for 2017 good reading.