Hacking for "signals intelligence" doesn't take NSA-level resources; it doesn't even require very sophisticated exploit tools. Using a combination of Windows and Android malware and some very simple social engineering, a group aligned with the regime of Syrian President Bashar Al-Assad have raked in a wealth of intelligence on Syrian opposition groups. And they did it by pretending to be women and flirting with their victims.

Over the past two years, using a combination of fake social media and Skype accounts associated with fictional female supporters of Syrian rebel groups, the group—apparently operating from Lebanon—fooled rebel soldiers and others providing aid to them into downloading malware to their computers and Android smartphones. As revealed in a report published today by FireEye (PDF), the group (which may have been associated with Hezbollah) was able to harvest not just personal information on their targets, but also battle plans and other intelligence information that could have been used by Hezbollah and the Syrian government's troops to counter the opposition.

FireEye discovered the operation during a malware investigation, uncovering a cache of 7.7 gigabytes of stolen data on a German server. The data contains Skype databases including chat logs and contacts, as well as documents and images.

In one conversation found in the logs, an attacker posed as a woman named Iman, claiming to be "a computer engineer working for a programming company in Beirut." The attacker asked for a photo of the target and then sent a picture of her own—a picture that the victim was too busy mooning over to realize it came packed with malware (in a .PIF file, essentially a DOS command launcher for Windows XP).

The attack group created a collection of Skype, Facebook, and other social media accounts around specific false identities, using profile photos of Muslim women. Some images depicted covered heads and sunglasses, and others were less modest photos depending on the group targeted.

During Skype chats, the attackers would ask the targets whether they were on Skype on their computer or on a mobile device. They would use that information to determine which set of malware to offer: one packaged for Windows or a package for Android.

In addition to malicious photos, they would sometimes offer a link to an installer for another video chat software package that included malware. The Facebook profiles of the faked identities included posts and links that were supportive of the Syrian opposition, in addition to links to a fake pro-opposition website constructed with content scraped from other sites.

Hot live ISIS chat

The fake site has one other feature that uses a play torn out of a well-worn fraudster playbook re-formatted for the Islamic jihadist age. FireEye noted that it included "what appears to be a matchmaking section that covertly channels targets toward installing malware." Profiles of veiled women are presented on the site, with links to a "LiveCam ID" and their "Facebook profile." The LiveCam link prompts the download of an ooVoo software package bundled with malware. The Facebook link goes to a fake Facebook login page, which steals the victim's credentials.

Information gathered by the malware dropped on targets included a set of marked-up battle plans for a coordinated 2013 attack against Assad government forces to liberate the town of Khirbet Ghazaleh, near the city of Daraa. Other data discovered included:

Battle plans and other military documents—including lists of troops. "The threat group took a range of military-related information and seemed to pay special attention to files that contained lists of names," FireEye reported. "We found dozens of lists identifying hundreds of fighters serving in armed opposition groups. Some lists included names and birthdates, while others noted the weapons and serial numbers each man carried, their blood types, and their phone numbers."

Political strategy and information on alliances between rebel groups. According to FireEye's report, Skype logs provided the attackers with "an inside view into the politics of the Syrian opposition, as individuals discussed coalitions, criticized people, and shifted alliances." There were also documents on opposition political parties, the structure of opposition groups, and other information on the leanings of individuals in the Syrian diaspora.

Humanitarian aid documents including requests for aid and shipment and border crossing data.

The personal information of people applying for refugee status in Turkey.

Media releases, casualty reports, situational reports, and information on rights abuses.

Because the devices used by attack victims were often shared with multiple other users due to limited Internet connectivity for opposition groups, fooling just one victim paid off several times over. The attackers were able to steal multiple Skype databases off the same machine. They were also able to identify other targets from contact lists. And since the attackers succeeded in targeting mobile phones, they were able to compromise real-time communications in the field, giving them insight into what was going on in the battlefield.