Threats Feed

Marco Ramilli provides an independent technical analysis of the Jason Exchange Mail BF tool (v7.0), leaked by Lab Dookhtegan on June 3, 2019, as part of the APT34 tool exposure on Telegram. Jason is a graphical .NET tool designed to brute-force Microsoft Exchange accounts and harvest email addresses and account credentials. It was distributed in a ZIP container containing three components: Jason.exe (the GUI frontend), Microsoft.Exchange.WebService.dll (version 15.0.0.0, dated to 2012 despite a last-available 2015 release — suggesting the tool may have been initially developed or frozen around that period), and a password pattern library (PassSample folder with Year.txt, numspecial.txt, num4.txt, num4special.txt, and username/password list files). Three attack modes are selectable: EWS (Exchange Web Services), OAB (Offline Address Book), or both simultaneously; a DNS domain discovery function is also present in the code for auto-detecting Exchange servers. The tool supports configurable thread counts for attack speed tuning. Ramilli notes the developer implemented extensive exception-handling protections — checks for null bytes, variable validation, object index and key guards — which he interprets as either targeting non-technical end users or reflecting professionally-trained development practices. He identifies weak code style similarities with other APT34 tools (Glimpse, WebMask) in exception protection patterns and file logging conventions, but explicitly withholds personal attribution, noting these similarities are insufficient for confident APT34 attribution beyond the trusted source (Lab Dookhtegan). The PDB path (D:\Project\Jason\obj\Release\Jason.pdb) and version string "Jason - Exchange Mail BF - v 7.0" confirm the internal project name. Ramilli publishes a YARA rule (_APT34_Jason) with 20 strings for detection. Source URL is no longer accessible; this analysis is based on the archived PDF attachment.

Telsy published the first public analysis of Jason on June 3, 2019 — the same day Lab Dookhtegan released it on Telegram — making this the earliest documented response to the leak. Jason is a .NET graphical tool designed to brute-force Exchange email accounts using OAB and EWS methods, with support for user/password lists loaded from text files and configurable multi-threading. The tool was not flagged by any VirusTotal engine at time of analysis; Telsy explicitly notes this and calls on security vendors to classify Jason and similar hacking tools as potentially malicious. Scan results are written to out-[datetime].txt files; debug and activity logs are saved to log.txt. Telsy characterizes the tool as "simple old-style appearing but potentially very effective" and notes that multiple versions appear to have been released over time, with version 7.0 likely dating to early 2019. On June 4, 2019, Telsy published a tlp:white YARA detection rule for Jason on their public GitHub repository (github.com/telsy-cyberops/research/blob/master/APT34/YARA), available for immediate use by defenders.

APT34 primarily targets Middle Eastern countries and international organizations across finance, government, energy, chemical engineering, and telecommunications sectors. Disclosed by Lab Dookhtegan, APT34 employs various attack methods, including SQL injection, brute-force cracking, and 0-day exploits. The group frequently uses web shells injected into compromised systems to maintain control. Top attacked countries include the United Arab Emirates, China, Jordan, and Saudi Arabia. The compromised enterprises predominantly belong to government (36%), finance (17%), service provider (12%), and media (7%) sectors. APT34's attacks typically begin with exploiting web vulnerabilities to gain initial access.

Since at least 2014, APT34, has targeted financial, government, energy, chemical, telecommunications, and other industries in the Middle East. Their Glimpse project uses a file-based command and control structure, including a VBS launcher and a PowerShell payload, with covert channels over DNS. Tools leaked on a Telegram channel were linked to OilRig, confirming their use in multiple intrusions across the Middle East and Asia. The attacks include sophisticated PowerShell scripts for command execution and data exfiltration.

APT34 has been leveraging DNS tunneling for command and control since May 2016. The leaked source code, revealed via a Telegram channel, includes projects like webmask which primarily focus on DNS hijacking and redirection attacks. The attacks target sectors such as technology firms, telecom companies, and gaming companies across the Middle East and Asia, with a particular focus on UAE. The setup involves using NodeJS and Python for DNS servers, an ICAP proxy server to intercept and modify connections, and Haproxy for high availability.

Hackers under the alias Lab Dookhtegan (لب دوختگان) leaked details about Iranian APT group OilRig (APT34), exposing tools, infrastructure, and victims. The dump, shared via Telegram, included the source code for tools like Poison Frog, DNSpionage (Webmask), and web shells (HyperShell, HighShell). Credentials, database dumps, and Mimikatz outputs from Middle Eastern government and corporate targets were revealed, including Dubai Media Inc, Etihad Airways, and Bahrain’s NSA. This disclosure highlights the targeting of government, aviation, energy, and media sectors, particularly in the UAE, Kuwait, Oman, and Bahrain.

The APT34/OILRIG group, linked to Iranian intelligence, had its operational details leaked by the "Lab Dookhtegan" group on Telegram. The leaks revealed a C2 infrastructure, PowerShell-based agents, ASP web shells ("HighShell" and "HyperShell"), and a DNS-based espionage toolset ("dnspionage"). These tools facilitate file transfer, credential theft and covert communication via proxies and DNS manipulation. The attackers also collected sensitive data, including domain admin credentials, indicating a potential target for high-value networks. While specific sectors or countries are not detailed, the tools suggest a focus on espionage and disruption. Other tools, such as 'MinionProject' and 'FoxPanel222', remain under analysis.

The OilRig group continued its espionage activities, primarily within the Middle East. Between May and June 2018, they orchestrated multiple attacks using compromised accounts from a Middle Eastern government agency, targeting a technology services provider and another government entity. The group leveraged a PowerShell backdoor called QUADAGENT and employed spear-phishing tactics, obfuscation using the Invoke-Obfuscation toolkit, and PE files to achieve their objectives. They also used stolen credentials and decoy dialog boxes to reduce suspicion and evade detection.

Booz Allen DarkLabs' Threat Hunt team pivoted from FireEye's December 2017 APT34 report to discover three previously unreported BONDUPDATER/POWRUNER variants, then extended that work using a ClearSky tip to find two more, yielding seven total malware samples linked to APT34 operations. All variants follow the same execution chain: a dropper (.exe) creates and runs rUpdateChecker.ps1 in a staging directory (C:\ProgramData\Windows\Microsoft\java\ or C:\Users\Public\Java), which creates a VBScript and a scheduled task to run the script every minute. The VBScript deploys POWRUNER — a PowerShell backdoor for arbitrary command execution and TCP-based data exfiltration — and in most variants also BONDUPDATER, a downloader that uses a domain generation algorithm (DGA) for DNS-based C2. The DGA for poison-frog[.]club variants generates subdomains from a unique victim ID (derived from MAC address or whoami), randomly inserted parameters, random hex characters, and hardcoded string elements — producing distinct send and receive subdomain formats. A second cluster, identified from a ClearSky tip, uses window5[.]win as the C2 domain with a URI of /update.aspx. Infrastructure pivoting confirmed that poison-frog[.]club, proxycheker[.]pro, and associated IPs (82.102.14.219, 94.23.172.164, 185.15.247.147) overlap with domains mentioned in the original FireEye report (dns-update[.]club, hpserver[.]online, anyportals[.]com), corroborating the APT34 attribution. Booz Allen also provides a YARA rule for static detection of the dropper binaries based on PDB path strings.

The Iranian cyber espionage group APT34 exploited two vulnerabilities (CVE-2017-0199 and CVE-2017-11882) in Microsoft Office to deliver malicious payloads against Middle Eastern governmental organizations. The group utilized spear-phishing emails with malicious .rtf files attached, which upon opening, exploited the vulnerabilities and executed malicious scripts. The scripts, POWRUNER and BONDUPDATER, performed actions such as persistence and command-and-control (C2) communication, including use of a domain generation algorithm (DGA) to evade detection.