Threats Feed

The Iranian APT group MalKamak has been targeting aerospace and telecommunications companies in the Middle East since at least 2018, with additional victims in the US, Russia and Europe. The group uses ShellClient, a newly discovered remote access trojan (RAT), to conduct highly targeted cyberattacks. ShellClient uses Dropbox, a popular cloud-based service, for command and control (C2) operations, replacing the group's previous C2 infrastructure.

Operation GhostShell is a cyber espionage campaign targeting aerospace and telecommunications companies, primarily in the Middle East, with victims in the U.S., Russia and Europe. The operation, carried out by the Iranian group MalKamak, uses a stealthy, evolving remote access trojan (RAT) called ShellClient, which has been in development since 2018. ShellClient evades detection through masquerading, AES encryption and WMI-based reconnaissance. The attackers used tools such as PAExec for lateral movement and lsa.exe for credential dumping. Data exfiltration was facilitated by using WinRar to compress stolen information before sending it via Dropbox.

Ferocious Kitten, an APT group active since 2015, primarily targets Persian-speaking individuals in Iran using weaponized documents. The attack involves malicious macros in documents, such as “Romantic Solidarity With Lovers of Freedom2.doc”, to drop executables that display anti-regime messages. These executables, once enabled, ensure persistence by placing themselves in the startup directory. The group's malware, MarkiRAT, exhibits capabilities like process checking, logging keystrokes, hijacking Telegram installations, and communicating with a C2 server. It specifically targets security solutions like Kaspersky and Bitdefender, indicating a high level of sophistication and focus on evading detection.

Swascan's Cyber Security Research Team conducted first-hand incident response on Pay2Key attacks targeting European companies alongside the simultaneous Israeli campaign documented by Check Point Research. Swascan was one of the first teams to identify the ransomware, submitting Cobalt.Client.exe to VirusTotal on October 27, 2020 — the same day as the first confirmed attacks. Forensic investigation revealed that initial access occurred as early as October 20, 2020, with attackers entering via an exposed vulnerable service and using RDP to connect to compromised devices. From there, PsExec (PSEXESVC.exe) was used to distribute the ransomware across the network. Swascan also identified Ngrok, hidden as dllhost.exe in Windows event logs, as a likely backdoor tool the attackers used to maintain persistent remote access to infected infrastructure. ConnectPC.exe was recovered from crash logs and confirmed as the internal proxy used to relay C2 communications. Ransom demands ranged from $100,000 to $200,000 in Bitcoin depending on company size and the number of compromised devices — a higher ceiling than reported by Check Point. Full-network encryption completed in approximately three hours, with the active encryption phase taking roughly one hour. Only two antivirus engines flagged the sample on initial VirusTotal submission, indicating very low detection at time of deployment. Note: the original source URL is no longer accessible (404); this analysis is based on the archived PDF attachment.

Check Point Research documents the emergence of Pay2Key, a previously unknown ransomware strain that targeted multiple Israeli corporations in late October and early November 2020. The attacker — believed to be a non-native English speaker and later linked by MITRE to the Fox Kitten threat group — gained initial access through RDP connections, then deployed a custom proxy tool (ConnectPC.exe) on one compromised machine to route all C2 traffic internally, minimizing external network noise. PsExec was used to push the ransomware binary (Cobalt.Client.exe) across the network, achieving full-organization encryption within approximately one hour of initial access. Pay2Key is written in C++ and internally named "Cobalt"; it was under active development at the time of publication, with multiple sample versions compiled within days of each other. The ransomware uses a hybrid AES and RSA encryption scheme, with the RSA public key delivered by the C2 server at runtime — meaning encryption fails if C2 connectivity is unavailable. Each victim received a customized ransom note and encrypted file extension, with demands ranging from 7 to 9 Bitcoin (approximately $110,000–$140,000 at the time). A self-killing mechanism was added in later samples to remove artifacts and reboot the machine post-encryption. Check Point notes the ransomware does not use a packer and was barely detected on VirusTotal at the time of initial analysis, suggesting the actor invested in operational security through proxy design rather than binary obfuscation.

The joint advisory from CISA and the FBI reveals that an Iranian advanced persistent threat (APT) actor targeted U.S. state websites, specifically election websites, in an attempt to influence the 2020 presidential election. The actor employed methods like scanning with Acunetix, exploiting public-facing applications, and using VPN services to masquerade their operations. The APT also attempted to access and distribute U.S. voter registration data, which was subsequently used in disinformation campaigns misleadingly attributed to domestic sources. The operations spanned from September 20 to October 17, 2020, aiming to compromise election infrastructure and gather sensitive information.

Iranian APTs are suspected of attempting to disrupt the U.S. electoral process to undermine public confidence and create discord among voters. These activities have included the creation of fictitious and spoofed media sites to distribute misinformation about voter issues, utilizing voter-registration data, and spreading anti-American sentiments. The APT groups have exploited critical vulnerabilities such as CVE-2020-5902 and CVE-2017-9248, impacting VPNs and content management systems, to conduct distributed denial-of-service (DDoS) attacks, SQL injection attacks, spear-phishing campaigns, website defacements, and disinformation campaigns.

In April 2020, Iran-based threat actor TRACER KITTEN targeted a telecommunications company in the EMEA region, leveraging valid credentials and custom backdoors for persistent access and C2 communications. The adversary employed SSH tunnels, masqueraded tools, and rogue Windows services to evade detection. Credential theft attempts involved LSASS dumps via comsvcs.dll and a modified Mimikatz. Reconnaissance was extensive, using native Windows tools to enumerate users, groups, and services, followed by a pass-the-hash attempt with Invoke-TheHash. Early detection allowed defenders to mitigate potential data exfiltration.

Dragos identified RASPITE as a distinct activity group targeting electric utilities since at least early-to-mid 2017, with confirmed targeting in the US, Europe (including Saudi Arabia), and East Asia (including Japan). The group overlaps significantly with Symantec's LEAFMINER and uses identical initial access methodology to DYMALLOY and ALLANITE: compromising legitimate websites to embed hidden resource links that force visitors' browsers to initiate SMB connections, transmitting Windows NTLM credential hashes to attacker-controlled servers for offline cracking. Once credentials are obtained, RASPITE deploys install scripts for a malicious Windows service that beacons back to actor-controlled infrastructure, enabling remote access via RDP. The group spoofs domains for legitimate IT services to blend C2 traffic into normal network activity. While RASPITE's operations focus exclusively on IT networks within ICS-operating entities — particularly electric utilities — and it has not demonstrated ICS-specific or disruptive capabilities to date, Dragos assesses its targeting methodology and persistence as preparatory activity for potential future ICS operations. The group's focus on electric utility initial access operations mirrors the early stages seen before more impactful ICS attacks.

The Greenbug espionage group is conducting an information-gathering campaign against telecommunications companies in South Asia. Using a mix of off-the-shelf tools and living-off-the-land techniques, the group primarily employs email as the initial infection vector. Notable files used for infection are proposal_pakistan110.chm:error.html and GRUNTStager.hta, often delivered through compromised websites via spearphishing. The group aims to gain access to database servers, leveraging tools like Covenant and custom malware like Trojan.Ismdoor. They have been observed using various PowerShell commands, Mimikatz, and Cobalt Strike, alongside multiple webshells. Living-off-the-land utilities such as Plink and Bitvise were used to establish tunnels back to attacker-controlled infrastructure.

The Nazar APT's backdoor, showcases a suite of espionage tools used for malicious activities. It employs a passive approach, utilizing the discontinued Packet Sniffer SDK (PSSDK) for communication. Key capabilities include a keylogger that saves data in %WINSYSDIR%\report.txt, system shutdown through an OLE object, screen capture saved in %CWD%\z.png, audio recording saved as %WINSYSDIR%\music.mp3, and enumeration of drives, files, and installed programs with results stored in %WINSYSDIR%. Additionally, it can remove files, list devices, perform a ping operation, and gather OS information. This malware is specifically designed for espionage, indicating a focus on data extraction and system information discovery.

The Nazar APT, active since at least 2010, employs a modular toolkit for cyber espionage. Its main dropper registers multiple DLLs as OLE controls in the Windows registry using 'regsvr32.exe'. It includes a service disguised as 'svchost.exe' for persistence, and uses custom and repurposed libraries for various functionalities like keylogging, audio capture, and screen capture. Nazar's droppers, built with Chilkat's 'Zip2Secure', are often misidentified by antivirus software. A notable feature is EYService, a passive backdoor listening on UDP port '1234', enabling commands like ping response, victim info requests, and file downloads. Additionally, it uses a packet sniffer for potentially sophisticated command-and-control activities. The report, however, does not specify targeted countries or sectors.

The RogueRobin malware, developed by the DarkHydrus group, employs DNS tunneling for covert communications in cyberattacks targeting government and educational institutions. The malware appears in two variants: a PowerShell and a .NET executable, both facilitating commands and control operations via encoded DNS queries. This series explores differences in their operation, emphasizing persistence methods and anti-analysis tactics. The technical nuances of RogueRobin, including its innovative DNS record types, highlight its role in sophisticated cyber espionage campaigns.

The xHunt Campaign targeted government organizations in Kuwait, compromising a website to create a watering hole. Between May and December 2019, the threat actors injected HTML code to harvest NTLM hashes from visitors, potentially allowing them to infiltrate organizations undetected, steal sensitive information, and even implement backdoors for future access. Concurrent DNS redirect activity was observed, implying an interest in user credential harvesting. The attack involved use of the Responder tool and was linked with previous xHunt activities, including the Hisoka campaign. Intriguingly, some of the infrastructure used in the attack showed overlaps with the activity of known threat groups, OilRig and Chafer.

The Dustman is a data-wiping malware believed to be of Iranian origin, characterized by its use of shared code with another wiper called "ZeroCleare." It exhibits features of blatant copy-pasting from a GitHub repository without credit. The malware includes a muldrop executable containing three encrypted files: a VirtualBox driver from WinNT/Turla, a modified Eldos RawDisk driver, and a malware agent application. The agent application wipes data using the string "Down With Saudi Kingdom Down With Bin Salman." The initial dropper is a modified version of the TDL (Furutaka) project, indicating that the malware targets entities with connections to Saudi Arabia, exploiting vulnerabilities in internet-facing applications.

The IBM X-Force IRIS report details the emergence of Dustman, a malware variant in the Wiper class, related to the previously identified ZeroCleare. Discovered in attacks in the Middle East, Dustman is primarily used for destructive purposes, targeting regional organizations. It shares similarities with ZeroCleare in components, including the use of the Turla driver and an EldoS RawDisk driver for disk wiping. However, Dustman shows differences in deployment flow and file names. The malware consists of a binary file, Dustman.exe, which loads the EldoS RawDisk driver, and an agent.exe binary identified as the wiper. Despite these similarities, Dustman features a modified execution order and distinct political messaging, targeting both fixed and removable drives.

DomainTools demonstrates how passive DNS pivoting on ISMDoor's static IPv6 response fingerprints can be used to systematically discover Greenbug's C2 infrastructure — including domains not previously reported. The analysis confirms ISMDoor remained active as recently as November 2019, more than two years after the malware's initial public disclosure in 2017. By querying passive DNS for four known static IPv6 addresses returned during ISMDoor's session establishment protocol (a67d:db8:a2a1:7334:7654:4325:370:2aa3, a67d:db8:85a3:4325:7654:8a2a:370:7334, the all-spaces address 2020:2020:..., and the "Ok" response 4f6b:2020:...), DomainTools identified 19 C2 domains across old and current infrastructure. Most were already sinkholed, but winrepp[.]com was still active on Digital Ocean at the time of publication. Pivoting from that IP and then from outbrainsecupdater[.]com revealed an additional 37 associated domains, including microsoft-publisher[.]com confirmed as an ISMDoor C2 through captured AAAA query data. The report notes that Greenbug's use of DNS tunneling remains effective because many organizations do not monitor DNS traffic for behavioral anomalies. The static IPv6 fingerprints embedded in ISMDoor's session establishment provide a durable detection opportunity regardless of which C2 domain the malware uses — a technique DomainTools notes can be applied to hunt for other DNS-tunneling malware families as well.

The Ismdoor malware, linked with the GreenBug group, continues its cyberattacks using DNS tunneling to evade detection, communicate with command and control servers, and exfiltrate data. Black Lotus Labs detected recent spikes in such activities related to the domain basnevs[.]com, associated with Ismdoor. The malware uses encoded subdomains for data exfiltration and receives hex-encoded messages from the C2. An increase in tunneling activity suggests that too many organizations still allow unmonitored DNS traffic, which amplifies the risk of successful DNS tunneling attacks. The report doesn't explicitly mention specific targeted countries or sectors.

CrowdStrike Intelligence's January 2019 report documents a widespread DNS hijacking campaign active from at least February 2017 through January 2019, affecting 28 organizations across 12 countries. The campaign primarily targeted entities in the Middle East and North Africa, with limited impact in Europe and the United States. Affected sectors included government (the dominant target across Jordan, Kuwait, UAE, Iraq, Egypt, Libya, Lebanon, Albania, Cyprus, and Saudi Arabia), law enforcement, civil aviation, insurance, telecommunications, and internet infrastructure providers including ISPs, internet exchange points, root DNS servers, and TLD operators. The attack method involved hijacking victim organizations' DNS records to redirect traffic to actor-controlled IP addresses. Fraudulent TLS certificates were then obtained — primarily through Let's Encrypt — enabling the actors to present trusted HTTPS connections to victims redirected to malicious infrastructure. Most hijacked domains remained redirected for very short windows (sometimes under 24 hours), though one domain was hijacked for over a month. Five actor-controlled name server domains were used as malicious authoritative DNS: cloudipnameserver.com, cloudnamedns.com, lcjcomputing.com, mmfasi.com, and interaland.com. CrowdStrike assessed that the likely objectives were direct traffic interception, credential collection, and potential malware delivery against targeted organizations. Public reporting at the time pointed to a possible Iranian nexus, though CrowdStrike stated definitive attribution was inconclusive at the time of publication.

DarkHydrus, an adversary group operating primarily in the Middle East, has resumed activities with new tactics, tools, and procedures (TTPs). Recently analyzed by security researchers, the group has been deploying a new variant of the RogueRobin trojan, which now utilizes Google Drive API for command and control (C2) communications. This shift to using legitimate cloud services for C2 indicates an evolution in their operational tactics. The trojan, delivered through macro-enabled Excel documents, exhibits sophisticated evasion techniques, including environment checks and dynamic DNS to mask its C2 communications. The analysis revealed the use of typosquatting and open-source penetration testing tools, underscoring the group’s persistent and evolving threat landscape.

CERT-OPMD (Openminded) published a detailed incident response analysis of a live DNSpionage intrusion in January 2019, focusing on post-compromise internal actions not visible to Cisco Talos from their telemetry. The attackers conducted advanced LinkedIn-based spearphishing, impersonating a Wipro HR recruiter for several days before delivering a malicious document (using the hr-wipro[.]com and hr-suncor[.]com domains observed by Talos). After initial compromise via the DNSpionage backdoor, attackers used batch scripts to perform full recursive directory listings across all drives and exfiltrated results via HTTP to the C2 at 0ffice36o[.]com. They conducted extensive discovery using native Windows tools including WMIC, net, ping, ipconfig, and reg query, identified domain admins, and scanned for antivirus. Credential dumping was performed via Mimikatz (sekurlsa::logonpasswords) invoked through PowerShell with execution bypass. Lateral movement used Plink (plink32.exe) to create SSH tunnels on port 443 to attacker-controlled IP 185.236.78.63, enabling RDP access to internal servers. Files including PowerShell scripts and tools were copied via Windows Admin Shares (net use). The C2 communicated over both HTTP (port 80) and DNS (Base32-encoded queries to 0ffice36o[.]com subdomains), with the malware switching between modes. Openminded confirmed Bitvise WinSSHD was installed for remote access, and Veil-Pillage was used alongside Mimikatz for credential operations.

Mandiant's January 2019 report was the first public disclosure of a large-scale DNS hijacking campaign affecting domains across the Middle East and North Africa, Europe, and North America from January 2017 to January 2019. The attackers manipulated both DNS A records (changing the IP address a domain resolves to) and NS records (changing the authoritative name server for a domain), redirecting victim traffic through attacker-controlled infrastructure. SSL certificates were obtained for the hijacked domains to prevent browser warnings and make the interception transparent to victims. Credentials were harvested from the intercepted traffic. Targeted sectors included government, telecommunications, internet infrastructure providers, and other organizations across the MENA region. Mandiant noted that some techniques observed were previously associated with Iranian cyber espionage activity, leading to the assessment of a suspected Iranian nexus — though definitive attribution was not established. The campaign operated in waves, with multiple hijacking operations conducted at different times targeting organizations in different countries. Mandiant's analysis was published shortly before CrowdStrike's complementary report, prompting coordinated government-level advisories from CISA and other agencies urging immediate DNS record monitoring and registrar account security hardening.

Unit 42's continued investigation into the Shamoon 3 attacks on an oil and gas organization revealed a new wiper Trojan related to the Disttrack malware, utilizing the SuperDelete tool's modified source code. Unlike previous variants, this wiper doesn't spread across networks but overwrites files with random data, complicating recovery. Notably, it carries a religious message, discovered only upon in-depth analysis. Further analysis identified Loader and Spreader Trojans, indicating a sophisticated approach to distribute the wiper across compromised networks, echoing tactics from Shamoon 2.