Threats Feed

SafeBreach Labs discovered an Iranian threat actor exploiting the MSHTML vulnerability (CVE-2021-40444) to infect Farsi-speaking victims with the PowerShortShell stealer via spear phishing. The attack, first reported in September 2021, involved a malicious Word document connecting to a server, downloading a DLL, and executing a PowerShell script. This script collected data, including screenshots and files, and exfiltrated it to the attacker's server. The campaign targeted Iranians abroad, particularly in the United States, suggesting ties to Iran's Islamic regime.

Some Iranian government-sponsored APT groups have exploited vulnerabilities in Microsoft Exchange servers and Fortinet devices since March 2021. These actors broadly targeted critical infrastructure sectors in the US, including Transportation and Healthcare and Public Health, as well as Australian organizations. The APT group focused more on exploiting known vulnerabilities rather than specific sectors, using the gained access for ransomware deployment, data exfiltration, and extortion. Several tactics, techniques, and tools were utilized, including creating new user accounts and modifying Task Scheduler.

Swascan's Cyber Security Research Team conducted first-hand incident response on Pay2Key attacks targeting European companies alongside the simultaneous Israeli campaign documented by Check Point Research. Swascan was one of the first teams to identify the ransomware, submitting Cobalt.Client.exe to VirusTotal on October 27, 2020 — the same day as the first confirmed attacks. Forensic investigation revealed that initial access occurred as early as October 20, 2020, with attackers entering via an exposed vulnerable service and using RDP to connect to compromised devices. From there, PsExec (PSEXESVC.exe) was used to distribute the ransomware across the network. Swascan also identified Ngrok, hidden as dllhost.exe in Windows event logs, as a likely backdoor tool the attackers used to maintain persistent remote access to infected infrastructure. ConnectPC.exe was recovered from crash logs and confirmed as the internal proxy used to relay C2 communications. Ransom demands ranged from $100,000 to $200,000 in Bitcoin depending on company size and the number of compromised devices — a higher ceiling than reported by Check Point. Full-network encryption completed in approximately three hours, with the active encryption phase taking roughly one hour. Only two antivirus engines flagged the sample on initial VirusTotal submission, indicating very low detection at time of deployment. Note: the original source URL is no longer accessible (404); this analysis is based on the archived PDF attachment.

Check Point Research documents the emergence of Pay2Key, a previously unknown ransomware strain that targeted multiple Israeli corporations in late October and early November 2020. The attacker — believed to be a non-native English speaker and later linked by MITRE to the Fox Kitten threat group — gained initial access through RDP connections, then deployed a custom proxy tool (ConnectPC.exe) on one compromised machine to route all C2 traffic internally, minimizing external network noise. PsExec was used to push the ransomware binary (Cobalt.Client.exe) across the network, achieving full-organization encryption within approximately one hour of initial access. Pay2Key is written in C++ and internally named "Cobalt"; it was under active development at the time of publication, with multiple sample versions compiled within days of each other. The ransomware uses a hybrid AES and RSA encryption scheme, with the RSA public key delivered by the C2 server at runtime — meaning encryption fails if C2 connectivity is unavailable. Each victim received a customized ransom note and encrypted file extension, with demands ranging from 7 to 9 Bitcoin (approximately $110,000–$140,000 at the time). A self-killing mechanism was added in later samples to remove artifacts and reboot the machine post-encryption. Check Point notes the ransomware does not use a packer and was barely detected on VirusTotal at the time of initial analysis, suggesting the actor invested in operational security through proxy design rather than binary obfuscation.

The joint advisory from CISA and the FBI reveals that an Iranian advanced persistent threat (APT) actor targeted U.S. state websites, specifically election websites, in an attempt to influence the 2020 presidential election. The actor employed methods like scanning with Acunetix, exploiting public-facing applications, and using VPN services to masquerade their operations. The APT also attempted to access and distribute U.S. voter registration data, which was subsequently used in disinformation campaigns misleadingly attributed to domestic sources. The operations spanned from September 20 to October 17, 2020, aiming to compromise election infrastructure and gather sensitive information.

Iranian APTs are suspected of attempting to disrupt the U.S. electoral process to undermine public confidence and create discord among voters. These activities have included the creation of fictitious and spoofed media sites to distribute misinformation about voter issues, utilizing voter-registration data, and spreading anti-American sentiments. The APT groups have exploited critical vulnerabilities such as CVE-2020-5902 and CVE-2017-9248, impacting VPNs and content management systems, to conduct distributed denial-of-service (DDoS) attacks, SQL injection attacks, spear-phishing campaigns, website defacements, and disinformation campaigns.

The xHunt Campaign targeted government organizations in Kuwait, compromising a website to create a watering hole. Between May and December 2019, the threat actors injected HTML code to harvest NTLM hashes from visitors, potentially allowing them to infiltrate organizations undetected, steal sensitive information, and even implement backdoors for future access. Concurrent DNS redirect activity was observed, implying an interest in user credential harvesting. The attack involved use of the Responder tool and was linked with previous xHunt activities, including the Hisoka campaign. Intriguingly, some of the infrastructure used in the attack showed overlaps with the activity of known threat groups, OilRig and Chafer.

The Dustman is a data-wiping malware believed to be of Iranian origin, characterized by its use of shared code with another wiper called "ZeroCleare." It exhibits features of blatant copy-pasting from a GitHub repository without credit. The malware includes a muldrop executable containing three encrypted files: a VirtualBox driver from WinNT/Turla, a modified Eldos RawDisk driver, and a malware agent application. The agent application wipes data using the string "Down With Saudi Kingdom Down With Bin Salman." The initial dropper is a modified version of the TDL (Furutaka) project, indicating that the malware targets entities with connections to Saudi Arabia, exploiting vulnerabilities in internet-facing applications.

The IBM X-Force IRIS report details the emergence of Dustman, a malware variant in the Wiper class, related to the previously identified ZeroCleare. Discovered in attacks in the Middle East, Dustman is primarily used for destructive purposes, targeting regional organizations. It shares similarities with ZeroCleare in components, including the use of the Turla driver and an EldoS RawDisk driver for disk wiping. However, Dustman shows differences in deployment flow and file names. The malware consists of a binary file, Dustman.exe, which loads the EldoS RawDisk driver, and an agent.exe binary identified as the wiper. Despite these similarities, Dustman features a modified execution order and distinct political messaging, targeting both fixed and removable drives.

CrowdStrike Intelligence's January 2019 report documents a widespread DNS hijacking campaign active from at least February 2017 through January 2019, affecting 28 organizations across 12 countries. The campaign primarily targeted entities in the Middle East and North Africa, with limited impact in Europe and the United States. Affected sectors included government (the dominant target across Jordan, Kuwait, UAE, Iraq, Egypt, Libya, Lebanon, Albania, Cyprus, and Saudi Arabia), law enforcement, civil aviation, insurance, telecommunications, and internet infrastructure providers including ISPs, internet exchange points, root DNS servers, and TLD operators. The attack method involved hijacking victim organizations' DNS records to redirect traffic to actor-controlled IP addresses. Fraudulent TLS certificates were then obtained — primarily through Let's Encrypt — enabling the actors to present trusted HTTPS connections to victims redirected to malicious infrastructure. Most hijacked domains remained redirected for very short windows (sometimes under 24 hours), though one domain was hijacked for over a month. Five actor-controlled name server domains were used as malicious authoritative DNS: cloudipnameserver.com, cloudnamedns.com, lcjcomputing.com, mmfasi.com, and interaland.com. CrowdStrike assessed that the likely objectives were direct traffic interception, credential collection, and potential malware delivery against targeted organizations. Public reporting at the time pointed to a possible Iranian nexus, though CrowdStrike stated definitive attribution was inconclusive at the time of publication.

CERT-OPMD (Openminded) published a detailed incident response analysis of a live DNSpionage intrusion in January 2019, focusing on post-compromise internal actions not visible to Cisco Talos from their telemetry. The attackers conducted advanced LinkedIn-based spearphishing, impersonating a Wipro HR recruiter for several days before delivering a malicious document (using the hr-wipro[.]com and hr-suncor[.]com domains observed by Talos). After initial compromise via the DNSpionage backdoor, attackers used batch scripts to perform full recursive directory listings across all drives and exfiltrated results via HTTP to the C2 at 0ffice36o[.]com. They conducted extensive discovery using native Windows tools including WMIC, net, ping, ipconfig, and reg query, identified domain admins, and scanned for antivirus. Credential dumping was performed via Mimikatz (sekurlsa::logonpasswords) invoked through PowerShell with execution bypass. Lateral movement used Plink (plink32.exe) to create SSH tunnels on port 443 to attacker-controlled IP 185.236.78.63, enabling RDP access to internal servers. Files including PowerShell scripts and tools were copied via Windows Admin Shares (net use). The C2 communicated over both HTTP (port 80) and DNS (Base32-encoded queries to 0ffice36o[.]com subdomains), with the malware switching between modes. Openminded confirmed Bitvise WinSSHD was installed for remote access, and Veil-Pillage was used alongside Mimikatz for credential operations.

Mandiant's January 2019 report was the first public disclosure of a large-scale DNS hijacking campaign affecting domains across the Middle East and North Africa, Europe, and North America from January 2017 to January 2019. The attackers manipulated both DNS A records (changing the IP address a domain resolves to) and NS records (changing the authoritative name server for a domain), redirecting victim traffic through attacker-controlled infrastructure. SSL certificates were obtained for the hijacked domains to prevent browser warnings and make the interception transparent to victims. Credentials were harvested from the intercepted traffic. Targeted sectors included government, telecommunications, internet infrastructure providers, and other organizations across the MENA region. Mandiant noted that some techniques observed were previously associated with Iranian cyber espionage activity, leading to the assessment of a suspected Iranian nexus — though definitive attribution was not established. The campaign operated in waves, with multiple hijacking operations conducted at different times targeting organizations in different countries. Mandiant's analysis was published shortly before CrowdStrike's complementary report, prompting coordinated government-level advisories from CISA and other agencies urging immediate DNS record monitoring and registrar account security hardening.

Unit 42's continued investigation into the Shamoon 3 attacks on an oil and gas organization revealed a new wiper Trojan related to the Disttrack malware, utilizing the SuperDelete tool's modified source code. Unlike previous variants, this wiper doesn't spread across networks but overwrites files with random data, complicating recovery. Notably, it carries a religious message, discovered only upon in-depth analysis. Further analysis identified Loader and Spreader Trojans, indicating a sophisticated approach to distribute the wiper across compromised networks, echoing tactics from Shamoon 2.

McAfee Advanced Threat Research identified a new Shamoon Version 3 variant in December 2018, first detected when the Foundstone Emergency Incident Response team reacted to a customer breach. The variant targeted oil, gas, energy, telecom, and government organizations across the Middle East and southern Europe. Shamoon V3 operates as a modular dropper carrying three embedded components: a communication module (MNU), a wiper (LNG), and a 64-bit dropper (PIC). The wiper installs a malicious service named MaintenaceSrv and uses the ElRawDisk.sys driver to overwrite all files with garbage data before forcing a system reboot, leaving machines inoperable. The malware includes anti-forensic timestomping (faking file dates to August 2012), UAC bypass via token impersonation, and spreads laterally over ADMIN$ and Windows admin shares. The modular design means the wiper component can be detached and weaponized independently, making this variant particularly dangerous for future repurposing.

The SamSam ransomware group exploited vulnerabilities in Windows servers and JBoss applications, predominantly targeting organizations in the United States, with victims also reported internationally. The group focused on critical infrastructure sectors and other industries, leveraging stolen Remote Desktop Protocol (RDP) credentials obtained from darknet marketplaces. Using brute force and exploitation techniques, SamSam actors gained persistent access, escalated privileges, deployed ransomware, and encrypted entire networks to demand Bitcoin ransoms. Victims received instructions via Tor for ransom payment and decryption. The rapid execution of attacks and the sale of stolen credentials often resulted in additional unauthorized activities on victim networks.

Cisco Talos discovered a targeted campaign in November 2018 affecting government domains in Lebanon and the UAE, as well as Middle East Airlines. The attackers operated on two tracks simultaneously. First, they delivered a custom backdoor called DNSpionage via malicious Word documents hosted on fake job listing websites (hr-wipro[.]com and hr-suncor[.]com), which used embedded macros to drop and execute a remote administration tool supporting both HTTP and DNS command-and-control. The malware stored commands in a fake Wikipedia page, used a custom per-target Base64 alphabet for obfuscation, and communicated over DNS by encoding data as Base32-encoded subdomain queries to 0ffice36o[.]com. Second, the same actor conducted parallel DNS redirection attacks against specific government and airline hostnames in Lebanon and the UAE between September and November 2018 — redirecting email and VPN domains to attacker-controlled IP 185.20.187.8 after pre-generating matching Let's Encrypt certificates, enabling silent interception of credentials and potentially MFA codes. Named redirected domains included the Lebanese Finance Ministry's webmail, Abu Dhabi Police VPN, UAE Ministry of Government Services mail, UAE Telecommunications Regulatory Authority mail, and multiple Middle East Airlines domains. Talos assessed both activities originated from the same actor and confirmed victims in Lebanon and the UAE via DNS telemetry data. No attribution to a specific group was established.

Symantec's October 2018 analysis documented 67 confirmed SamSam targets during 2018, with 56 located in the United States. Healthcare was the single most affected sector, accounting for 24 percent of attacks, followed by local government organizations — at least one of which was involved in election administration. The group's most high-profile attack hit the City of Atlanta in March 2018, causing cleanup costs estimated at over $10 million; an attack on the Colorado Department of Transportation resulted in an additional $1.5 million in remediation costs. A November 2018 update confirmed that a US DOJ indictment of two Iranian nationals placed total ransom received at $6 million and damages to victims at over $30 million. SamSam operators employed "living off the land" tactics throughout — using legitimate administrative tools including PsExec, PsInfo, and Mimikatz rather than custom malware for reconnaissance, credential theft, and lateral movement. A documented February 2018 attack showed more than 48 hours elapsed between initial intrusion and encryption, during which the attackers mapped the network, harvested credentials, and staged two SamSam variants before encrypting nearly 250 computers in a single five-hour window. Outside the US, a small number of attacks were confirmed in Portugal, France, Australia, Ireland, and Israel.

SamSam ransomware selectively targets organizations likely to pay ransom, such as hospitals and schools. Unlike indiscriminate ransomware campaigns, attackers exploit vulnerabilities or use brute-force attacks on weak RDP credentials to gain initial access. After infection, SamSam spreads laterally by network mapping and credential theft, deploying ransomware manually via PSEXEC and batch scripts. The malware executes through a runner component, decrypting the payload using a separate DLL. Attackers erase forensic traces by deleting execution-related files. Victims can pay per host or a total sum for decryption. SamSam has generated significant profits in Bitcoin payments, shifting wallet addresses over time to evade tracking.

A new variant of the SamSam ransomware has netted over $325,000 in four weeks, targeting government, healthcare, and industrial control systems (ICS). The attacks are opportunistic, with potential initial access through compromised RDP/VNC servers. The ransomware is deployed manually, encrypting files using DES and AES encryption. New anti-analysis techniques, including string obfuscation and a loader-based deployment mechanism ("Runner"), make detection more challenging. Unlike most ransomware, SamSam does not delete Volume Shadow Copies, allowing possible file recovery. The campaign uses hardcoded Tor addresses and Bitcoin wallets for ransom transactions, with payments being tracked on the blockchain. The US and other regions are likely affected, given past SamSam activity.

A Saudi Arabian Government entity has been targeted by an innovative attack that relies on macros within malicious Word documents and leverages various scripts rather than a binary payload. The attack uses a VBScript to lower security settings within Microsoft Word and Excel and fetches data from Pastebin. A PowerShell script then communicates with the C2 server and exfiltrates data, persistently remaining undetected and continuing to collect information from the targeted system. The primary targeted sector is the Government.

Unit 42 uncovered the TwoFace webshell, a sophisticated dual-component tool used by attackers for prolonged unauthorized access within a Middle Eastern organization's network. The TwoFace webshell enabled execution of various commands and facilitated lateral movement by copying itself across servers. The intruders utilized Mimikatz to harvest credentials and orchestrated their attacks from multiple international IP addresses, suggesting a broad geographic operational footprint. Analysis revealed that the attackers maintained access since at least June 2016, using obfuscated C# code on ASP.NET servers to remain undetected and manage the webshell payload.

Shamoon, the destructive disk-wiping malware that crippled tens of thousands of Saudi Aramco workstations in 2012, resurfaced in November 2016 in a new wave of attacks against Saudi Arabian organizations. The updated variant, W32.Disttrack.B, closely mirrors its predecessor: it overwrites master boot records with a politically themed image and renders infected systems unbootable. Critically, the attackers did not exploit software vulnerabilities — they used legitimate, pre-stolen credentials to authenticate across the network and deploy the malware at scale. The malware itself consists of three components: a dropper that installs the package, a wiper that destroys data and overwrites the MBR, and a reporter module that communicates results back to a command-and-control server. Symantec's analysis identified a direct link to the Greenbug espionage group, whose activity on at least one targeted network ceased the day before Shamoon detonated — strongly suggesting Greenbug served as the initial access broker that collected the credentials enabling the attack.

The SamSam ransomware campaign exploited vulnerabilities in public-facing JBoss application servers, leveraging JexBoss for initial access. The attackers gained a foothold, moved laterally across networks, and deployed SamSam ransomware to encrypt Windows systems. The healthcare sector was a primary target, with ransom demands increasing over time—from 1 BTC per system to 1.7 BTC. Attackers also introduced a bulk decryption option for 22 BTC. REGeorg's tunnel.jsp was used to maintain access. The malware employed Rijndael encryption with RSA-2048 key wrapping, rendering files unrecoverable without payment. The campaign demonstrated a shift from phishing to direct server exploitation, highlighting the evolving nature of ransomware attacks.