Afghanistan/Taliban – Two US soldiers were killed by a suicide bomber who targeted a convoy of foreign forces in Afghanistan's southern province of Kandahar, according to security officials. NATO confirmed in a statement the convoy was targeted on the 2 Aug 17 in an attack that did "cause casualties". "At around noon a car bomb targeted a convoy of foreign forces in Daman area of Kandahar," Zia Durrani, Kandahar province's police spokesman, said. A US Pentagon spokesman confirmed that at least two casualties were US soldiers. "Two US service members were killed in action in Kandahar, Afghanistan, when their convoy came under attack," Navy Captain Jeff Davis said. "US Forces Afghanistan will provide additional information as it becomes available." Qari Yusuf Ahmadi, a Taliban spokesman, claimed responsibility for the attack, saying it took place near an Afghan intelligence quick reaction force base in the Shor Andam area of Daman district. Witnesses reported seeing two foreign vehicles in the area on fire. The Taliban are very active in that area, and for the past few days there has been a lot of fighting between the group and Afghan security forces. There is a lot of concern here about the growing violence in the country and anger [with people] wondering why the Afghan government cannot protect its people.
Afghanistan – At least 40 Taliban fighters have been killed in a gun battle with Afghan security forces that lasted for 12 hours in the southern Helmand province reported by local media on the 4 Aug 17. The clashes erupted after the fighters attacked a local market in the centre of Gereshk district on the morning of the 4 Aug 17 TOLOnews, an Afghan news outlet, reported. The clashes are the latest in a series of attacks to have hit Afghanistan this week. On the 3 Aug 17 at least five security officials were killed and several wounded in a Taliban-claimed car bomb attack near their check post, also in the Gereshk district. One NATO soldier was killed and six other personnel - including five soldiers and an interpreter - were wounded in an attack in the Qarabagh district in Kabul province claimed by the Taliban on the night of the 3 Aug 17. Earlier this week, a suicide bombing and gun attack claimed by the Islamic State of Iraq and the Levant (ISIL, also known as ISIS) group on the Iraqi embassy in the capital killed two Afghan employees. A total of 2,531 Afghan security forces were killed and 4,238 wounded in the first four months of 2017, according to the Special Inspector General for Afghanistan (SIGAR).
Afghanistan/Da’esh/Taliban – The Taliban and the Da’esh group jointly killed scores of civilians in a village in Afghanistan, officials claimed on the 7 Aug 17. If confirmed, the attack on the 5 Aug 17 would highlight rare cooperation between the armed groups. Fighters killed more than 50 men, women and children in the remote Sayad district of northern Sar-e Pul province after overrunning government-backed fighters of the Afghan Local Police (ALP) in a 48-hour battle, according to local officials. "It was a joint operation by ISIL and Taliban fighters," Zabihullah Amani, spokesman for the provincial governor, told said on the 7 Aug 17. "They had recruited forces from other provinces of the country and attacked Mirzawalang village." The spokesman alleged that dozens of Taliban and ISIL fighters under the command of Sher Mohammad Ghazanfar, a local Taliban commander who Amani claims pledged allegiance to ISIL, launched a coordinated attack on the area on the 3 Aug 17. "The fighters overran the area, and it led to the massacre of innocent and defenceless civilians," he said. Most of those killed were shot, but some were beheaded, Amani said. Afghan President Ashraf Ghani on the 6 Aug 17 condemned the killings as a "war crime". "This barbaric act of them is deemed a direct violation of human rights and a war crime," Ghani said in a statement. Mohammad Noor Rahmani, head of Sar-e-Pul's provincial council, said 44 of the 50 victims were believed to be civilians, with ALP also suffering casualties. "This is not the final toll," he said. "It might change because the area is inaccessible and no telephone networks are working to get an update." Taliban and ISIL fighters have regularly clashed since the latter gained a foothold in eastern Afghanistan in 2015, as the two vie for supremacy in the war-torn country. An Afghan security source said there had been around three incidents in the past where fighters from both groups had teamed up to deal a blow to Afghan forces in certain areas. Zabihullah Mujahid, a spokesman for the Taliban, confirmed that it had captured Mirzawalang village but said it had done so alone. "It was an independent operation by our mujahedeen forces," said Mujahid. "There is no cooperation with the Islamic State on the operation," The Taliban also rejected reports of civilian casualties as "hollow propaganda by the enemy". Fighting has intensified this year across Afghanistan, with multiple security incidents recorded almost daily. In a recent report, the Special Inspector General for Afghanistan Reconstruction (SIGAR), a US oversight body, said 60 percent of Afghanistan's districts are under government control, while the remaining 40 percent are held by the Taliban or other armed groups.
Afghanistan/United States/Afghanistan – The Taliban called on President Donald Trump on the 14 Jul 17 to review the strategy for the war in Afghanistan and to hold peaceful dialogue directly with Afghans instead of engaging "corrupt" politicians. Written in a tone of negotiation, the Taliban asked Trump to study the "historical mistakes" of his predecessors and to withdraw troops from Afghanistan completely. The letter urged the US to interact with Afghans "generously" instead of imposing war. "It seems to be a historical mistake on part of the previous administrations to have dispatched American youth for the slaughter of Afghans. However, as a responsible American president, you need to study the mistakes of your predecessors and prevent death and injury to American forces in Afghanistan," it said. "American youth are not born to be killed in the deserts and mountains of Afghanistan in order to establish the writ of thieves and corrupt officials and neither would their parents approve of them killing civilians in Afghanistan," the letter said. The Taliban also accused Afghan politicians and generals of protracting the war and occupation for personal gain. "A number of warmongering congressmen and generals in Afghanistan are pressing you to protract the war in Afghanistan because they seek to preserve their military privileges, but instead you must act responsibly as the fate of many Americans and Afghans alike is tied to this issue." Afghanistan's interior ministry declined to comment when contacted. In a press conference on the 13 Aug 17 US Defence Secretary James Mattis said all options for Afghanistan remained on the table, and a full withdrawal of troops is one of them. Trump has yet to announce a strategy for Afghanistan, but Mattis said one is "very, very close". Possible plans include sending thousands more troops into the nearly 16-year conflict, or taking the opposite tack and pulling out, leaving private military contractors to help the Afghans oversee the fragile security situation. Erik Prince, founder of the private security company Blackwater, has offered his private military force for Afghanistan, proposing a two-year plan in which American troops - aside from a handful of special forces - would be replaced by his army of about 5,500 contractors who would train Afghan soldiers and join them in the fight against the Taliban. However, the Taliban said privatising the war effort would be a grave mistake. If the war can't be won with "professional US and NATO troops ... you shall never be able to win it with mercenaries, notorious contractor firms, and immoral stooges", the Taliban letter said.
Afghanistan – At least five people were killed and 42 wounded when a suicide attacker detonated a car bomb near a police headquarters in Afghanistan's Helmand province on the 23 Aug 17 officials said. The explosion struck a crowd of policemen and soldiers who had gathered to collect their pay in Helmand's capital city, Lashkar Gah, provincial police chief Abdul Ghafar Safai said. Two local women, two soldiers, and a child died in the blast and their bodies were taken to the hospital, along with more than 40 wounded, a doctor at the hospital said. He said the toll could rise. Militants had previously attacked security forces gathered to collect their pay at a bank in Lashkar Gah in Jun 17. That prompted officials to move a bank branch into the city's police headquarters to improve security.
Afghanistan – Several people were reported killed on the 25 Aug 17 after attackers stormed a Shi’ite mosque in the Afghan capital, Kabul. Police and witnesses reported that there were sounds of explosions and gunfire at the scene of the attack, but details remained sketchy. Interior Ministry spokesman Najeeb Danish told RFE/RL that a “terrorist attack” took place at around 1320 hrs local at the Imam Zaman Mosque in Kabul’s Qala-e Najara area. “There might be two or three terrorists involved,” he added. “We have begun our clearance operation and two terrorists have already been killed in the area.” A Health Ministry spokesman, Mohammad Ismail Kawoosi, said the attack left at least two people dead and eight others wounded. Kabul police spokesman Abdul Basir Mujahid said a suicide bomber "detonated himself inside the mosque where worshippers had gathered for Friday Prayers. An unidentified police official quoted witnesses as reporting a blast followed by gunfire. Other witnesses said that gunmen threw grenades before entering the mosque. At the time of reporting no group claimed responsibility for the attack but later the Islamic State claimed responsibility. Shi’a are a minority in Afghanistan who have been threatened and attacked in the past by various Sunni militant groups, including Islamic State and Taliban extremists.
Afghanistan/Taliban – A Taliban suicide bomber killed at least 13 people and wounded several more in an attack on a convoy of Afghan soldiers in southern Helmand province late on the 27 Aug 17 an official said. It was the latest in a series of deadly blows to Afghanistan's beleaguered security forces and yet again underlined spiralling insecurity in the war-torn nation. "A suicide bomber detonated an explosive-filled car as the Afghan National Army convoy passed a small market in Nawa District of Helmand," Omar Zwak, a spokesman for the provincial governor said. He added that civilians and forces personnel were among the dead while more than a dozen others had been wounded. A source working at a nearby hospital said that the bodies of 15 victims had been brought to the hospital. Another 19 injured were also admitted, he added. "The majority of the dead belong to Afghan forces and most of the wounded are civilians," the source said. The Taliban claimed responsibility for the attack in a WhatsApp message sent to journalists. The deadly assault came days after a Taliban suicide bomber killed five civilians and wounded dozens of others, mainly children, when he detonated a car filled with explosives at a police headquarters in Lashkar Gah, Helmand's capital. That attack was the insurgents' first major one since US President Donald Trump announced he was committing American troops to Afghanistan indefinitely. At least 80 percent of the province is controlled by the Taliban, reported DPA news agency. The resurgent Taliban are at the peak of their summer fighting season and have been ramping up their campaign against government forces. Afghan police and troops - beset by a high death toll, desertions and nonexistent "ghost soldiers" on the payroll - have been struggling to beat back the Taliban since US-led NATO troops ended their combat mission in Dec 14. Casualties among Afghan security forces soared by 35 percent in 2016, with 6,800 soldiers and police killed, according to US watchdog SIGAR. More than 2,500 Afghan police and troops were killed from the 1 Jan 17 to 8 May 17.
Afghanistan/Taliban – A suicide bomber blew himself up at a bank in the Afghan capital, killing at least five people and wounding several others, officials said on the 29 Aug 17. The bomber hit the entrance to a Kabul Bank branch close to the US embassy and the city's main diplomatic quarter, Najib Danish, an interior ministry spokesman said. The front side of the Kabul Bank was completely shattered and there was much damage to the fronts of several adjacent businesses. Danish said at least five people were killed. The attack also wounded nine, said Mohammad Salim Rasouli, chief of Kabul hospitals at the Health Ministry. He warned that the casualty toll could rise. The blast occurred on a street lined with shops and banks at a time when many officials were collecting their salaries before the Muslim Eid holiday at the end of the week. The Taliban claimed responsibility for the attack. Zabihullah Mujahid, a spokesman for the group, said the bomber targeted a section of the bank where soldiers and police were waiting to receive their salaries.
Australia/United States – The US has ordered a review of security on cargo flights amid fears that they could be targeted by terrorists it was reported on the 28 Aug 17. Fears that the flights could be vulnerable were heightened last month after the Australian authorities foiled attempts by the Islamic State to bring down an aircraft. The plot entailed shipping the components for a bomb from Turkey to Australia on a commercial cargo flight before assembling the device and placing it on a passenger aircraft. According to CNN, this has triggered a review of cargo security by the Transportation Security Administration. The review is the latest move to head off potential terrorist threats to aviation by the US authorities. In Mar 17 passengers from 10 Middle Eastern and North African airports were banned from bringing laptops and tablet devices into the cabin. At one point the US was looking to extend the restrictions to European airports, but backed down following resistance from the EU. In Jul 17 the ban portable electronic devices was lifted after the airports involved tightened up security. In November 2010 a bomb was found on a UPS flight at East Midlands Airport by Leicestershire police officers. The device, which was timed to detonate over the US eastern seaboard, was disguised as an ink cartridge, It was discovered following a tip-off from Saudi intelligence. A second device was found in Yemen and both bombs were thought to have been put together by al-Q'aeda. The discoveries led the UK to step up screening of air freight sent to the UK from high-risk countries. Details of the review were not disclosed by the TSA. In a statement, the TSA said it was "raise the baseline on transportation security domestically and internationally and cargo security is a part of that effort." "While there is no specific or credible terrorist threat to the US, we're working closely with our partners in law enforcement and the shipping industry to ensure our nation's ports and cargo facilities are secure," the statement said. "Intelligence is one of our best tools to protect Americans from attacks. Every day, with our colleagues in the intelligence community, we evaluate and re-evaluate intelligence to ensure we're doing everything in our power to address all threats to transportation security."
Kashmir/India – Indian troops have killed at least three suspected fighters in a gun battle in Indian-administered Kashmir, officials say - an incident that has led to another round of protests. Fighting erupted in the divided Himalayan region after government forces raided a cluster of homes on a tip that the fighters were hiding in north-western Sopore area, Muneer Ahmed Khan, police inspector general, said on the 5 Aug 17. He said that as the soldiers began searching homes, they came under gunfire from the fighters. A police statement said the men belonged to the Lashkar-e-Taiba group. Police on the 1 Aug 17 had killed one of the group's senior Kashmir leaders, Abu Dajana. As the news of the latest killings spread thousands protested and clashed with police in several parts of the region as residents chanted slogans against India and in favour of the fighters who have fought against New Delhi's rule since 1989. Soldiers fired at rock-throwing protesters in Bandipora area and wounded at least three civilians. Tension has grown recently with at least 10 fighters and four civilians killed in gun battles and in protests. Two Indian army soldiers were also killed in an ambush by fighters. India and Pakistan each administer part of Kashmir, but both claim the Himalayan territory in its entirety. Armed groups demand that Kashmir be united either under Pakistani rule or as an independent country. Anti-India sentiment runs deep in Kashmir's predominantly Muslim population and most people support the fighters' cause against Indian rule. The anti-India protests and clashes have persisted despite the Indian army chief warning recently that "tough action" would be taken against stone throwers during counter attacks.
Kashmir/United States/Hizbul Mujahideen – The United States has designated Hizbul Mujahideen, the largest armed group in Indian-administered Kashmir, as a "foreign terrorist" organisation, imposing sanctions on it including the freezing of assets it may hold in the US. The US Department of State said in a statement on the 16 Aug 17 that Washington is seeking to deny the group "the resources it needs to carry out terrorist attacks". "Terrorism designations expose and isolate organisations and individuals, and deny them access to the US financial system. Moreover, designations can assist the law enforcement activities of US agencies and other governments." Hizbul Mujahideen is the largest indigenous armed group fighting against Indian rule in the Himalayan territory since an armed rebellion broke out in 1989. In Jun 17 the US had also designated as "terrorist" the group's leader Syed Salahuddin, also known as Mohammad Yusuf Shah. In Jul 16 the killing of Hizbul Mujahideen leader Burwan Wani sparked months of anti-India protests in which scores of people died. Kashmir has been divided between India and Pakistan since the end of British rule in 1947. Both claim the disputed territory in its entirety. Several armed rebel groups are fighting against Indian rule in Kashmir, with tens of thousands of people, most of them civilians, killed in the nearly three decades-old conflict. Anti-India sentiment runs deep in Kashmir's predominantly Muslim population, and most people support the fighters' cause against Indian rule. Nearly 70,000 people have been killed in the uprising and the ensuing Indian military crackdown. In recent years, Kashmiris, mainly young people, have displayed open solidarity with anti-Indian fighters and sought to protect them by engaging troops in street clashes during military operations. The anti-India protests and clashes have persisted despite the Indian army chief warning recently that "tough action" would be taken against stone throwers during counter attacks. India accuses Pakistan of arming and training the fighters, which Pakistan denies.
Myanmar/the Arakan Rohingya Salvation Army (ARSA) – At least 21 Rohingya fighters and 11 members of Myanmar's security forces were reportedly killed in Rakhine state after a rebel group launched pre-dawn raids on police posts and tried to break into an army base. Myanmar's army chief, Min Aung Hlaing, announced the death toll on a Facebook page, claiming that coordinated attacks by an estimated 150 fighters began at around 1am in the northern Maungdaw township. The 25 Aug 17 clashes came hours after a panel led by former UN chief Kofi Annan urged Myanmar to lift restrictions on movement and citizenship for Rohingya, a persecuted Muslim minority. The Arakan Rohingya Salvation Army (ARSA) claimed responsibility for the attacks in a Twitter post, but did not mention casualty figures. The ARSA, accusing the Myanmar forces of killings and rape, said on the 25 Aug 17 it was "taking defensive actions" in more than 25 different locations. The township of Rathetaung in northern Rakhine has been under "a blockade for more than two weeks which is starving the Rohingya people to death", it said. "As they prepare to do the same in Maungdaw … we had to eventually step up in order to drive the Burmese colonising forces away." It warned of more attacks to come. The ARSA was formed by Rohingya living in Saudi Arabia after a bout of serious communal violence in 2012, according to the International Crisis Group. A statement by Myanmar's de facto leader Aung San Suu Kyi's office said "extremist Bengali insurgents attacked a police station in Maungdaw region in northern Rakhine state with a handmade bomb explosive and held coordinated attacks on several police posts". The statement used the term "Bengali", a derogatory way to describe the Rohingya, implying they are illegal immigrants from Bangladesh. The fighters had seized weapons from police, Suu Kyi's office said. After a period of easing violence, tensions rose again in recent weeks with the military moving hundreds of troops into remote villages to flush out fighters amid a spate of killings of Buddhists. The Rohingya are denied citizenship in Myanmar and classified as illegal immigrants from Bangladesh, despite claiming roots in the region that go back centuries. There are approximately 1.1 million Rohingya in Myanmar. The mistreatment of the Rohingya, often described as the world's most persecuted minority, has emerged as Myanmar's most contentious human rights issue as it makes a transition from decades of military rule. The UN believes Myanmar security forces may have committed crimes against humanity against the Rohingya. The military rejects the allegations. Annan's Rakhine commission said Suu Kyi's government should respond to the crisis in a "calibrated" way without excessive force. It warned of radicalisation on both sides if problems were not addressed quickly, advising Myanmar to address the Rohingya's "legitimate concerns". The commission was formed last year at Suu Kyi's request, and her government has previously vowed to abide by its findings. Journalists and observers are denied access to northern Rakhine, and the government has refused entry to a UN mission seeking to investigate human rights abuses there.
Arakan Rohingya Salvation Army
The Arakan Rohingya Salvation Army (ARSA), also known by its former name Harakah al-Yaqin and by its former English name the Faith Movement, is a Rohingya insurgent group active in the jungles of northern Rakhine State, Myanmar. It is led by Ata Ullah, a Rohingya man who was born in Karachi, Pakistan, and grew up in Mecca, Saudi Arabia. According to the lead interrogator of ARSA suspects jailed in Sittwe, Police Captain Yan Naing Latt, the group's goal is to create a "democratic Muslim state for the Rohingya". Although there is no firm evidence linking the ARSA to foreign Islamist groups, the Burmese government suspects that the group is involved with and subsidized by foreign Islamists. The Burmese government has also accused the ARSA of murdering 34 to 44 civilians and kidnapping 22 others in reprisal attacks against those the ARSA have perceived as government collaborators. These claims have been denied by the ARSA, who have stated that they "have no links to terrorist groups or foreign Islamists" and that their "only target is the oppressive Burmese regime". According to Rohingya locals and Burmese security officials, the group began approaching Rohingya men from various villages for recruitment six months prior to their first attack in October, and trained them across the border in Bangladesh. In Oct 16, the group, calling itself Harakah al-Yaqin (or the Faith Movement in English), claimed responsibility for attacks on Burmese border posts along the Bangladesh-Myanmar border, which left 9 border officers and 4 soldiers dead. On the 15 Nov 16, the Tatmadaw (Myanmar Armed Forces) announced that a total of 69 insurgents had been killed by security forces in the recent fighting. On the 14 Dec 16, the International Crisis Group (ICG) reported that in interviews, the leaders of the group claimed to have links to private individuals in Saudi Arabia and Pakistan. The ICG also reported that Rohingya villagers had been "secretly trained" by Afghan and Pakistani fighters. On the 22 Jun 17, Burmese state media reported that three insurgents had been killed by security forces in a raid on an insurgent camp supposedly belonging to the ARSA, as part of a two-day "area clearance operation" by the government. Authorities confiscated gunpowder, ski masks and wooden rifles suspected to have been used for training.
Pakistan – A bomb blast on the 7 Aug 17 wounded at least 22 people in the eastern Pakistani city of Lahore, a government official said, with no one immediately claiming responsibility. Attacks in the Punjab provincial capital have become less frequent over the past couple of years but Islamist militant groups are still active there and periodically carry out major attacks. "It was a bomb blast in a fruit truck that wounded 22 persons," provincial Punjabi government spokesman Malik Muhammad Ahmad Khan said. Haider Ashraf, deputy inspector general of police, said the truck was loaded with explosives and experts were combing through the wreckage.
Pakistan/Baloch Liberation Army (BLA) – A roadside bomb killed eight soldiers in a remote district in Pakistan's south-western province of Baluchistan, a government official said on the 15 Aug 17 the second attack within days in the troubled region. The blast late on the 14 Aug 17 in Harnai district was some 160 km (100 miles) east of the provincial capital, Quetta, where a suicide bomber rammed his motorcycle into an army truck on the 12 Aug 17 killing eight soldiers and seven civilians. The separatist Baloch Liberation Army (BLA) group claimed responsibility for the bombing in phone calls made to media in Quetta. Islamic State said it carried out the 12 Aug 17 bombing. Army chief General Qamar Bajwa said the attack was an attempt to mar celebrations on the 14 Aug 17 as Pakistan celebrated 70 years since independence from British colonial rule. "Our resolve won't succumb to any challenge," Bajwa said in a statement the army media wing posted on Twitter. Separatist militants in Baluchistan have waged a campaign against the central government for decades, demanding a greater share of resources in the gas-rich province, which is a key part of a $57 billion Chinese economic corridor through Pakistan. The province, which shares border with Afghanistan and Iran, was rocked by a series of attacks late last year that raised concerns about a growing militant presence, including fighters affiliated with Islamic State.
Russia – Seven people have been wounded in a knife attack in the Russian city of Surgut, security sources say. The man, who apparently stabbed passers-by on the street at random, was shot dead by police. The injured have been taken to hospital, where two are in a critical condition, the state-owned RIA Novosti news agency reported on the 19 Aug 17. Russia's Investigations Committee said it had identified the attacker and was checking his psychological history. The attacker was a local resident born in 1994, it said. No motive has been established yet. A spokeswoman for the committee said she would not comment on the possibility of terrorist motives, calling the attack "attempted murder". The attack happened at about 1120 hrs local (0620 hrs GMT). An earlier statement said eight people had been wounded, but that was later revised to seven. Surgut, about 2,100km (1,300 miles) east of Moscow in the Khanty-Mansiysk area of Siberia, has a population of more than 350,000.
Thailand – Suspected militants raided a car dealership in southern Thailand and turned two of the cars into bombs, police said on the 17 Aug 17 adding that a "new generation" of Muslim separatists was operating in the insurgency-plagued region. A group of men raided the dealership in Songkhla province near the border with Malaysia on the 16 Aug 17 and made off with a car which exploded on a rural road in neighbouring Pattani province, prompting an exchange of gunfire, police said. A second car bomb exploded on the 17 Aug 17 damaging property. A car dealership employee who was held hostage was shot dead by the suspects, police said. One of the suspects was also killed in the violence. "We know the name of the group that was responsible for this incident. It is a new, younger generation, kind of group," Police Lieutenant General Sakorn Thongmanee, head of Provincial Police Region 9 said. Thailand's three southernmost provinces of Pattani, Yala and Narathiwat were once part of an independent Malay Muslim sultanate until annexed by Thailand in 1909. Insurgents from Thailand's Malay, Muslim minority want independence for the south. The groups rarely comment on attacks. Observers and groups monitoring the south said they were seeing signs of restlessness amongst a younger generation of separatists. "This might be a change in tactics because in the past the state has suppressed separatists considerably," Srisompop Jitpiromsri of Deep South Watch, an organization that monitors the violence said. Talks between the government and a handful of shadowy insurgent groups began in 2013 but little progress has been made.
Turkey/Iran/Jordan/Israel/Germany/United States – The Iran-backed cyber-espionage group CopyKittens has increased activities, launching attacks on governments, defence companies and academic institutions in support of Tehran’s political agenda, a report said on the 13 Aug 17. An investigative study by Israeli firm ClearSky Cybersecurity and Trend Micro called Operation Wilted Tulip traced CopyKittens’ activities to 2013, shedding light on its work patterns and possible motivations. The report revealed that CopyKittens’ activities mostly centred on espionage of strategic targets, particularly Saudi Arabia, Jordan, Turkey, Israel, Germany and the United States. The group extracted information from government organisations, academic institutions, online news sites and NGOs with the objective of gathering “as much information and data from target organisations as possible,” the report said. CopyKittens used rudimentary techniques, such as phishing, malicious e-mail attachments and, more recently, watering hole attacks to gather information. “It’s more that the methods they are using are efficient. They are getting out the data that they need to,” said Robert McArdle, director of research at Trend Micro, adding that the group’s lack of refinement makes it relatively easy to track CopyKittens’ activities compared to more sophisticated campaigns that could go on for years without being detected. McArdle said CopyKittens’ methods are of the more traditional variety, using exploits to take advantage of out-of-date systems, so if the user is missing updates or patches, an automatic infection is more likely. A lot of the group’s attacks go after the most vulnerable parts of any organisation — humans. “In any computer network security chain, the weakest link in always the human element,” said Iyad Barakat, a London-based digital analyst. “Groups more sophisticated than CopyKittens will try to target the human element in the chain, using techniques like a watering hole attack to simply extract passwords because these methods save them time, effort and usually have a higher success rate than the more sophisticated ones.” McArdle said an effective method to gain the human element’s trust is a social engineering campaign, which uses a number of psychological tricks to get the information needed to access a computer network. “Social engineering is relatively quick and easy to do in terms of setting up fake e-mail accounts or fake Facebook accounts or whichever social networking profile you are going with,” McArdle said, adding that effort is required to manage these resources and accounts. Social engineering can’t be stopped with traditional protection methods, said David Emm, principal security researcher at Kaspersky Lab. “Social engineering works and even if businesses have the right protection, without the right staff education they can fall victim,” Emm said. “Awareness is low in the Middle East as generally Western businesses have had longer to grapple with such issues.” One effective trick that CopyKittens used, McArdle said, is reaching important targets through other compromised accounts. Once CopyKittens gained access to an e-mail account in an organisation, it would not immediately try to take over higher-level targets in the company but log on and wait for a natural conversation to start between the person whose account it controls and the target. It might then reply to an e-mail thread, saying: “You might want to open this link.” During the Gulf Information Security Expo and Conference in May in Dubai, experts urged for more cybersecurity cooperation between countries in the Gulf Cooperation Council. The Middle East cyber-security market is projected to grow to $22.14 billion by 2022, with Saudi Arabia expected to contribute the largest share.
CopyKittens is an espionage group that has been attacking Israeli targets since at least August 2014. Among the targets are high ranking diplomats at Israel’s Ministry of Foreign Affairs and well-known Israeli academic researchers specializing in Middle East Studies. Matryoshka is the name we gave the malware built by CopyKittens. It is a multi-stage framework, with each part integrates into the subsequent one. CopyKittens assembled Matryoshka from code snippets picked from public repositories and online forums, hence their nickname. Matryoshka is spread through spear phishing with a document attached to it. The document has either a malicious macro that the victim is asked to enable, or an embedded executable the victim is asked to open. DNS requests and answers are used for command and control communication and for data exfiltration. Based on the type of targets, delivery, and malware used – we estimate that CopyKittens are a state actor or are endorsed by one. (Read the full report: The CopyKittens attack group.)
Turkey – Seven people were wounded when an explosion hit a shuttle bus carrying prison guards in the Turkish coastal province of Izmir on the 30 Aug 17 and authorities were investigating a possible terrorist attack, the local mayor said. The bus was hit as it passed a garbage container at around 0740 hrs local (0440 hrs GMT), Levent Piristina, the mayor of Izmir’s Buca district, said on Twitter. Photographs he posted on social media showed its windows blown out and its windscreen shattered. The force of the blast appeared to have blown out some of the bus’s panels, and the nearby street was littered with debris. “We are getting information from police sources and they are focusing on the possibility of a terrorist attack,” he said, adding that all seven wounded were in good condition. Both state-run TRT Haber and private broadcaster Dogan news agency said the explosion was caused by a bomb placed in the garbage container that exploded when the shuttle bus passed. No one immediately claimed responsibility. Both Kurdish militants and jihadist Islamic State militants have carried out suicide and bomb attacks in major Turkish cities in recent years.