Threats Feed

The ReversingLabs analysis, based on an FBI report, reveals that the Iranian-backed APT39 (Rana Corp) is using Android malware for state-sponsored surveillance, primarily targeting individuals deemed a threat by the Iranian government. The malware exploits smartphone features such as the camera and microphone to spy on users. It can intercept SMS, record audio, take photos and manipulate network connections. Obfuscation techniques were used, but analysis of an older sample revealed key capabilities for remote monitoring and control. The malware specifically monitors Iranian messaging apps, suggesting domestic surveillance. Targeted sectors include political dissidents and individuals of interest within Iran.

Rana Intelligence Computing Company (APT39) is an Iranian front group for the Ministry of Intelligence and Security (MOIS) that conducts cyber operations in Asia, Africa, Europe and North America. Its primary targets include the travel, telecommunications, hospitality, academic, and government sectors. Rana used malware delivered via spearphishing, using Visual Basic, PowerShell, AutoIt scripts and BITS malware to steal data, track individuals and maintain persistence. Their campaign targeted over 15 US companies, using scheduled tasks, encryption and obfuscation techniques to evade detection. Rana also deployed Android malware with root access capabilities for C2 communications, audio recording, and photo capture.

In October 2019, Aaron Stephens introduced the SCANdalous project, which automates the profiling of command and control (C2) servers used by threat groups. Prior to automation, analysts manually identified servers linked to groups like APT39 and APT34. APT39 employed SSH tunneling and specific server characteristics to evade detection, while APT34 used QUADAGENT malware and PowerShell-based tools like POSHC2 and POWERTON. These efforts led to early identification of malicious infrastructure, improving threat tracking capabilities.

Bitdefender's May 2020 whitepaper documents two Chafer APT campaigns dating to 2018 against air transportation and government targets in Kuwait and Saudi Arabia. The Kuwait attack was the more sophisticated of the two. Initial access was likely achieved via spearphishing with shellcode-laden documents executing Metasploit reverse TCP payloads. Attackers then deployed a full toolkit: CrackMapExec for network scanning, credential dumping, and account enumeration; Mimikatz (including a SafetyKatz variant and a customized version) for credential dumping; a modified Plink (wehsvc.exe) installed as a Windows service for C2 and tunneling; custom proxy tools (mini.exe, mfevtpse.exe) using SOCKS5 over HTTP disguised with bing.com host headers; and custom Python-based RATs (snmp.exe/imjpuexa.exe) using DNS and HTTP C2 channels that marshal packets to resemble legitimate DNS/HTTP traffic. A MechaFlounder-variant RAT (drivers.exe/dbxservice.exe) established persistence via scheduled tasks ("Defender Update" / "Service Update") and exfiltrated data to Dropbox — each victim had a separate folder named by machine+username combination. The RTLO character (U+202E) was used in filenames to spoof file extensions for defense evasion. Attackers created their own user accounts on compromised machines and operated primarily on weekends (Friday/Saturday — the regional weekend), suggesting awareness of Middle Eastern business hours. Scanning tools included a modified nbtscan variant (xnet.exe) and etblscanner.exe, an EternalBlue scanner written in Python. Shared PDB paths and compiler artifacts link xnet.exe to Remexi (mas.dll), connecting this campaign to prior Chafer infrastructure. The Saudi Arabia attack was simpler: social engineering led a user to execute a RAT directly from their Downloads folder (parent process: explorer.exe), suggesting the user was tricked into double-clicking a malicious file.

IBM X-Force researchers documented a sustained intrusion campaign by ITG07 — also tracked as Chafer and APT39 — targeting transportation sector organizations across multiple countries from at least September 2018 through mid-2019. The attackers gained initial footholds by exploiting public-facing applications and deploying webshells (JSPSPY, ASPXSPY), then moved laterally using stolen credentials harvested with a customized version of Mimikatz and legitimate remote access tools including Citrix and PsExec. A previously undocumented custom remote access trojan named TREKX was used to maintain persistent backdoor access. Microsoft BITS was abused for stealthy file transfer and data exfiltration. Internal reconnaissance was conducted using NBTscan. The campaign demonstrated a high level of operational sophistication, combining custom malware with living-off-the-land techniques to avoid detection.

The report provides a comprehensive analysis of a 64-bit backdoor executable associated with the Chafer APT group. The malware utilizes complex features such as process injection, task scheduling, and data obfuscation, along with automated exfiltration of information. It communicates with its C2 server via POST requests and employs encryption algorithms like RC4 and Blowfish to conceal its data and operations. Unusually, it masquerades by creating CAB files with non-standard prefixes and encrypting data in a manner that appears like a routine system operation.

In November 2018, the Iranian-linked Chafer threat group deployed a previously unseen Python-based backdoor called MechaFlounder against a Turkish government entity — marking the first confirmed use of a Python payload by this actor. The malware was compiled into a standalone executable using PyInstaller, allowing it to run on target systems without requiring a Python interpreter and making it harder to identify through file-type signatures alone. It was delivered from a malicious domain directly tied to prior Chafer infrastructure, indicating deliberate reuse of established operational resources. MechaFlounder functions as a fully capable remote access tool, supporting file upload and download, command execution, and C2 communication over HTTP using Base64-encoded data. Palo Alto Networks analysts noted that portions of MechaFlounder's code overlap with tooling associated with OilRig, a separate Iranian-linked threat group, suggesting a degree of code sharing or shared development resources between the two actors.

Throughout autumn 2018, Kaspersky researchers identified an active cyber-espionage campaign attributed to the Iran-based Chafer group, targeting foreign diplomatic entities operating inside Iran. The attackers deployed an updated version of Backdoor.Remexi — a Windows trojan capable of logging keystrokes, capturing screenshots, stealing browser credentials and history, and executing remote commands. The malware relied heavily on Microsoft's Background Intelligent Transfer Service (BITS) for both receiving commands and exfiltrating collected data, blending malicious traffic with legitimate Windows activity. Persistence was maintained through scheduled tasks and registry modifications. Encryption used XOR and RC4 algorithms with unique per-sample keys; one sample used the Farsi word for "health" as a key, reinforcing Iranian attribution. Kaspersky assessed the campaign as a likely domestic counter-intelligence operation.

APT39 is a cyber espionage group known for widespread theft of personal information, predominantly from the telecommunications and travel sectors. The group's operations are globally targeted but primarily concentrated in the Middle East. They involve monitoring, tracking, and conducting surveillance of specific individuals. The techniques used by APT39 include spear phishing, exploiting vulnerable web servers, and credential theft. Furthermore, APT39 deploys backdoors and uses various tools for privilege escalation, reconnaissance, lateral movement, and data extraction.

The Iran-based attack group, Chafer, escalated operations in 2017, striking more organizations within and beyond the Middle East. Utilizing several new tools, they targeted sectors including airlines, telecoms services, and IT services for transport sectors among others. Chafer sought to infiltrate a major telecoms services provider and an international travel reservations firm, likely aiming for widespread surveillance. The group employed malicious documents, SQL injection attacks, and newly adopted open-source tools to compromise targets. These activities indicate a growing threat, especially as Chafer shows a rising trend in attacks on supply chains.