Threats Feed

The SamSam ransomware group exploited vulnerabilities in Windows servers and JBoss applications, predominantly targeting organizations in the United States, with victims also reported internationally. The group focused on critical infrastructure sectors and other industries, leveraging stolen Remote Desktop Protocol (RDP) credentials obtained from darknet marketplaces. Using brute force and exploitation techniques, SamSam actors gained persistent access, escalated privileges, deployed ransomware, and encrypted entire networks to demand Bitcoin ransoms. Victims received instructions via Tor for ransom payment and decryption. The rapid execution of attacks and the sale of stolen credentials often resulted in additional unauthorized activities on victim networks.

Cisco Talos discovered a targeted campaign in November 2018 affecting government domains in Lebanon and the UAE, as well as Middle East Airlines. The attackers operated on two tracks simultaneously. First, they delivered a custom backdoor called DNSpionage via malicious Word documents hosted on fake job listing websites (hr-wipro[.]com and hr-suncor[.]com), which used embedded macros to drop and execute a remote administration tool supporting both HTTP and DNS command-and-control. The malware stored commands in a fake Wikipedia page, used a custom per-target Base64 alphabet for obfuscation, and communicated over DNS by encoding data as Base32-encoded subdomain queries to 0ffice36o[.]com. Second, the same actor conducted parallel DNS redirection attacks against specific government and airline hostnames in Lebanon and the UAE between September and November 2018 — redirecting email and VPN domains to attacker-controlled IP 185.20.187.8 after pre-generating matching Let's Encrypt certificates, enabling silent interception of credentials and potentially MFA codes. Named redirected domains included the Lebanese Finance Ministry's webmail, Abu Dhabi Police VPN, UAE Ministry of Government Services mail, UAE Telecommunications Regulatory Authority mail, and multiple Middle East Airlines domains. Talos assessed both activities originated from the same actor and confirmed victims in Lebanon and the UAE via DNS telemetry data. No attribution to a specific group was established.

Symantec's October 2018 analysis documented 67 confirmed SamSam targets during 2018, with 56 located in the United States. Healthcare was the single most affected sector, accounting for 24 percent of attacks, followed by local government organizations — at least one of which was involved in election administration. The group's most high-profile attack hit the City of Atlanta in March 2018, causing cleanup costs estimated at over $10 million; an attack on the Colorado Department of Transportation resulted in an additional $1.5 million in remediation costs. A November 2018 update confirmed that a US DOJ indictment of two Iranian nationals placed total ransom received at $6 million and damages to victims at over $30 million. SamSam operators employed "living off the land" tactics throughout — using legitimate administrative tools including PsExec, PsInfo, and Mimikatz rather than custom malware for reconnaissance, credential theft, and lateral movement. A documented February 2018 attack showed more than 48 hours elapsed between initial intrusion and encryption, during which the attackers mapped the network, harvested credentials, and staged two SamSam variants before encrypting nearly 250 computers in a single five-hour window. Outside the US, a small number of attacks were confirmed in Portugal, France, Australia, Ireland, and Israel.

Palo Alto Unit42 documents DarkHydrus conducting credential harvesting attacks against government entities and educational institutions in the Middle East using the open-source Phishery tool, with the campaign active from at least September 2017 through June 2018. Phishery performs two functions: it injects a remote template URL into Word documents (using the Office attachedTemplate technique) and hosts a C2 server to capture credentials entered into the authentication dialog box that Microsoft Office automatically presents when attempting to load the remote template. DarkHydrus used three malicious Word documents in this campaign. The September 2017 document displayed an employee survey as the decoy, and the November 2017 document displayed what appeared to be an internal password handover form — suggesting the actor may have had prior access to the organization's internal materials. The June 2018 document was empty after credential theft. In all cases, when the user opened the document, Word displayed a dialog asking them to authenticate to connect to a remote resource. DarkHydrus' C2 domain 0utl00k[.]net was engineered to resemble Microsoft Outlook's legitimate "outlook.com" domain. For the June 2018 attack, the specific subdomain used matched the name of the targeted educational institution — making the dialog appear to be an internal login prompt — significantly increasing the likelihood of credential submission. Unit42 confirmed DarkHydrus used Phishery by recreating the tool's output and matching the remote template path exactly, then successfully capturing test credentials via the same C2 flow. The use of an open-source tool is consistent with DarkHydrus's broader pattern of leveraging freely available offensive tools rather than developing custom malware.

Palo Alto Unit42 introduces DarkHydrus — a previously undisclosed threat group — and documents their July 2018 attack on at least one Middle Eastern government agency using a novel delivery mechanism: malicious Excel Web Query (.iqy) files hidden inside password-protected RAR archives sent via spearphishing. The .iqy file (credential.iqy) contains a single URL pointing to micrrosoft[.]net, which Excel natively fetches on open. The retrieved releasenotes.txt file contains an Excel formula that launches a cmd.exe subprocess to run a PowerShell one-liner, downloading and executing winupdate.ps1 — RogueRobin — from the same server. Both consent dialogs (one for remote data, one for command prompt execution) must be accepted by the user, making social engineering the critical success factor. RogueRobin performs five WMI-based sandbox checks (BIOS version for VBOX/bochs/qemu/virtualbox/vm strings, XEN manufacturer, physical memory <2.9GB, CPU cores ≤1) and enumerates processes for Wireshark and Sysinternals before proceeding. If checks pass, it writes OneDrive.ps1 to %APPDATA% and creates a startup folder shortcut (OneDrive.lnk) for persistence. All C2 communication uses a custom DNS tunneling protocol, testing eight DNS record types (A, AAAA, AC, CNAME, MX, TXT, SRV, SOA) on first run and using the first to receive a response for all subsequent communications. Each DNS query encodes a system ID, job ID, data offset, and base64-encoded data chunk in the subdomain. The eight C2 domains all spoof well-known security vendor brands (Cisco AnyConnect, F5 BIG-IP, Fortiweb, Kaspersky, MikroTik, OWA365, Symantec, Windows Defender). Infrastructure pivoting linked these domains through shared name servers (ns102/ns103.kaspersky[.]host) and revealed overlapping infrastructure with a second DarkHydrus credential harvesting campaign (0utl00k[.]net) and possible Copy Kittens connections (cisc0[.]net, per ClearSky reporting — unconfirmed by Unit42). Unit42 assesses DarkHydrus has been active since at least January 2016 and historically relied on open-source tools (Meterpreter, Cobalt Strike, Empire, Veil, Mimikatz) before pivoting to the custom RogueRobin payload in this campaign.

Symantec's July 2018 report exposed Leafminer, an Iran-based threat actor active since at least early 2017, targeting government organizations and multiple business sectors across the Middle East — including Saudi Arabia, the UAE, Qatar, Kuwait, Bahrain, Egypt, Israel, and Afghanistan. Symantec identified a critical operational security failure: Leafminer left a staging server publicly accessible, exposing their entire toolkit of 112 files including custom malware, exploitation frameworks, and reconnaissance logs. The group used three main intrusion methods: watering hole attacks that planted JavaScript to harvest SMB/NTLM credential hashes from visitors' browsers; vulnerability scanning and exploitation using the EternalBlue exploit (CVE-2017-0144/MS17-010) from the leaked Fuzzbunch framework for lateral movement; and dictionary/brute-force attacks against Exchange and RDP logins using THC Hydra and Total SMB BruteForcer. Custom malware included Backdoor.Sorgu (remote access) and Trojan.Imecab (persistent guest account creation). For credential dumping, the group deployed OrangeTeghal — a rebranded Mimikatz — using Process Doppelgänging to evade detection. Post-compromise tools included MailSniper, LaZagne, PsExec, HoboCopy, and SQL backup recovery utilities. Leafminer also scanned for Heartbleed (CVE-2014-0160). A target list written in Farsi containing 809 organizations was recovered from the staging server, grouping targets by geography and industry sector.

SamSam ransomware selectively targets organizations likely to pay ransom, such as hospitals and schools. Unlike indiscriminate ransomware campaigns, attackers exploit vulnerabilities or use brute-force attacks on weak RDP credentials to gain initial access. After infection, SamSam spreads laterally by network mapping and credential theft, deploying ransomware manually via PSEXEC and batch scripts. The malware executes through a runner component, decrypting the payload using a separate DLL. Attackers erase forensic traces by deleting execution-related files. Victims can pay per host or a total sum for decryption. SamSam has generated significant profits in Bitcoin payments, shifting wallet addresses over time to evade tracking.

A new variant of the SamSam ransomware has netted over $325,000 in four weeks, targeting government, healthcare, and industrial control systems (ICS). The attacks are opportunistic, with potential initial access through compromised RDP/VNC servers. The ransomware is deployed manually, encrypting files using DES and AES encryption. New anti-analysis techniques, including string obfuscation and a loader-based deployment mechanism ("Runner"), make detection more challenging. Unlike most ransomware, SamSam does not delete Volume Shadow Copies, allowing possible file recovery. The campaign uses hardcoded Tor addresses and Bitcoin wallets for ransom transactions, with payments being tracked on the blockchain. The US and other regions are likely affected, given past SamSam activity.

The Iranian threat agent Greenbug registered domains similar to Israeli high-tech and cybersecurity companies, as well as a Saudi Arabian electrical equipment firm. A sample of the ISMdoor malware was submitted from Iraq on October 15, 2017, indicating the threat actor's activities. Despite these registrations, no evidence of direct targeting or impact on these companies is present. High-tech, cybersecurity, online advertising, airport security systems, web development, behavioral biometrics, artificial intelligence, data security, and autonomous driving are sectors potentially of interest to the actor.

A Saudi Arabian Government entity has been targeted by an innovative attack that relies on macros within malicious Word documents and leverages various scripts rather than a binary payload. The attack uses a VBScript to lower security settings within Microsoft Word and Excel and fetches data from Pastebin. A PowerShell script then communicates with the C2 server and exfiltrates data, persistently remaining undetected and continuing to collect information from the targeted system. The primary targeted sector is the Government.

ClearSky Research Team documents new ISMAgent samples and infrastructure used by the Iranian threat group Greenbug in August 2017. The delivery chain begins with a malicious Word template file named "change managment.dot" that exploits CVE-2017-0199, a remote code execution vulnerability in Microsoft Office. Exploiting this vulnerability causes the document to reach out to msoffice-cdn[.]com and retrieve a remote template (template.rtf), which in turn executes a hidden PowerShell command. The PowerShell command downloads a file called ntluca.txt from a.pomf[.]cat — a file that appears to be a base64-encoded digital certificate but is actually an ISMAgent payload. The file is decoded on disk using the legitimate Windows utility certutil.exe, producing the ISMAgent executable (srvConhost.exe) which is then run silently. ClearSky provides a Maltego-based infrastructure graph mapping the relationships between the IOCs, including C2 IPs (74.91.19[.]122, 82.102.14[.]246, 185.162.235[.]121), domains (cdnmsnupdate[.]com, msoffice-cdn[.]com), and WHOIS registrant data (neslihan.ovcivit@mail.ru). Several of these IOCs overlap with OilRig infrastructure documented in a concurrent Palo Alto Networks report, suggesting shared or coordinated infrastructure between the two Iranian-linked groups. Source URL is no longer directly accessible; this analysis is based on the archived PDF attachment.

Unit 42 uncovered the TwoFace webshell, a sophisticated dual-component tool used by attackers for prolonged unauthorized access within a Middle Eastern organization's network. The TwoFace webshell enabled execution of various commands and facilitated lateral movement by copying itself across servers. The intruders utilized Mimikatz to harvest credentials and orchestrated their attacks from multiple international IP addresses, suggesting a broad geographic operational footprint. Analysis revealed that the attackers maintained access since at least June 2016, using obfuscated C# code on ASP.NET servers to remain undetected and manage the webshell payload.

NETSCOUT's ASERT team documents a significant evolution in Ismdoor, the custom remote access trojan used by the Iranian-linked Greenbug cyberespionage group. Where earlier versions used HTTP for command and control, the versions analyzed here replaced that entirely with a covert DNS-based C2 channel — communicating exclusively through AAAA DNS queries, encoding data as IPv6 addresses. The protocol is multi-layered: sessions are established via specially formatted query names containing a 32-character hex session ID, messages are base64-encoded and embedded in query subdomains, and responses are returned as static or data-carrying IPv6 addresses. File transfers use a separate session type with retransmission logic for missed packets. The malware supports over 20 C2 commands, including system information collection, self-update, credential dumping via Mimikatz (CreateMimi1Bat command invoking ccd61.ps1), keylogging (ExecuteKL), Powercat execution for network tunneling (ExecutePC), UAC bypass via RAAD, screenshot capture (PWS), and arbitrary command shell execution. Configuration is encrypted with a consistent substitution cipher and contains primary and secondary C2 domains, timeout values, and a unique bot identifier. NETSCOUT presents four indicators linking Ismdoor to the Shamoon/Disttrack campaigns against Saudi Arabia: Symantec observed an earlier Ismdoor variant on a Shamoon-targeted host shortly before Disttrack was deployed; all known DNS-variant samples were submitted to VirusTotal from Saudi Arabia; the CreateMimi1Bat command provides explicit credential-theft capability; and a McAfee blog on Shamoon traces a spearphishing email to the download and execution of an earlier Ismdoor variant. The link remains assessed as probable but unconfirmed at time of publication.

The BlackBerry Cylance threat research team's report offers a comprehensive analysis of the Disttrack malware, also known as Shamoon, renowned for its devastating attacks on system master boot records. The report traces the malware's history, its resurgence, and explores its technical operations, including network management capabilities and modular architecture. It particularly highlights Disttrack's impact on Saudi Arabia's critical infrastructure, demonstrating its potential for significant damage. This abstract succinctly captures the essence of the malware's threat and operational dynamics for a general audience.

NCC Group's Ahmed Zaki provides the first detailed technical analysis of ISM RAT (Ismdoor) version 5.0.0, the HTTP-based variant used by the Greenbug group before the group later switched to DNS tunneling. NCC identifies three versions of the RAT in the wild; v5.0.0 is the most capable, adding keylogging (WinIt.exe), Powercat-based shell access on port 4444, Mimikatz credential dumping, and UAC bypass via Invoke-BypassUAC and Invoke-PsUACme — the latter suspected to be from the Nishang PowerShell framework. All C2 communication uses HTTP POST requests to update.winappupdater[.]com with a WinHTTPClient user agent; key endpoints include /Home/CC (connection check), /Home/CR (command receive), /Home/AV (alive), and /Home/SCV (command result reporting). The SI command collects extensive system reconnaissance: username, IP configuration, network connections, running tasks, services, and installed AV/firewall products via WMIC — all written to a temporary .txt file and exfiltrated. NCC notes that the RAT's authors copy-pasted WinHTTP code directly from MSDN examples, left debugging messages in release builds, and used an unusual method to retrieve %TEMP% via a command prompt rather than the standard Windows API — leading the analysts to conclude the group is not technically sophisticated despite the breadth of their tooling. The RAT uses timer-queue callbacks for thread management and is assessed to be under active development given ongoing code refactoring and the introduction of versioning. Source URL is no longer accessible; this analysis is based on the archived PDF attachment.

The Greenbug cyberespionage group, active since June 2016, has been using Trojan.Ismdoor, a custom information-stealing remote access Trojan (RAT), and additional hacking tools to compromise organizations in the Middle East and a Saudi organization in Australia. The group targets sectors including aviation, energy, government, investment, and education, using spearphishing emails to deliver malicious payloads hidden in RAR archives. Once opened, the Trojan opens a backdoor and collects sensitive data, potentially facilitating further attacks. Notably, the group’s activity ceased a day before the destructive W32.Disttrack.B (Shamoon) attack in November 2016, suggesting a possible connection.

In mid-November 2016, Mandiant responded to the Shamoon 2.0 malware attack targeting organizations in the Gulf states, marking the return of the suspected Iranian hacker group "Cutting Sword of Justice." This updated version of the 2012 Shamoon malware features embedded credentials, suggesting previous targeted intrusions for credential harvesting. Shamoon 2.0 performs subnet scanning, uses domain-specific credentials for unauthorized access, modifies system registries, and schedules tasks for execution. Its payload involves overwriting system files and wiping boot records, notably shifting imagery from a burning U.S. flag to a photograph of Alan Kurdi, symbolizing a devastating critique through cyber vandalism.

Shamoon, the destructive disk-wiping malware that crippled tens of thousands of Saudi Aramco workstations in 2012, resurfaced in November 2016 in a new wave of attacks against Saudi Arabian organizations. The updated variant, W32.Disttrack.B, closely mirrors its predecessor: it overwrites master boot records with a politically themed image and renders infected systems unbootable. Critically, the attackers did not exploit software vulnerabilities — they used legitimate, pre-stolen credentials to authenticate across the network and deploy the malware at scale. The malware itself consists of three components: a dropper that installs the package, a wiper that destroys data and overwrites the MBR, and a reporter module that communicates results back to a command-and-control server. Symantec's analysis identified a direct link to the Greenbug espionage group, whose activity on at least one targeted network ceased the day before Shamoon detonated — strongly suggesting Greenbug served as the initial access broker that collected the credentials enabling the attack.

The Shamoon 2 campaign, a resurgence of the 2012 Shamoon attacks, targeted a Saudi Arabian organization to deliver the Disttrack malware, focusing on data destruction. Disttrack, comprised of dropper, communication, and wiper components, utilized stolen administrator credentials for network propagation and was designed to render infected systems unusable by overwriting data with politically motivated images. This attack notably aimed for maximum impact by initiating the wipe at the end of the Saudi workweek, exploiting periods when recovery efforts would be delayed. The lack of a functioning C2 server indicated a sole focus on destruction rather than espionage or data exfiltration.

Citizen Lab researchers identified Group5, a threat actor with probable Iranian ties, conducting a multi-platform surveillance campaign against members of the Syrian political opposition. The operation began in October 2015 when Noura Al-Ameer, a senior Syrian National Council official, received a spearphishing email carrying a malicious PowerPoint slideshow (PPSX) designed to look like Iranian human-rights documentation. The attackers also set up a watering hole site — assadcrimes[.]info — that distributed both Windows and Android malware. On the Windows side, Group5 deployed njRAT and NanoCore RAT, both obfuscated with a Persian-language crypter called PAC Crypt. One of the PowerPoint files exploited CVE-2014-4114 to silently install the RAT. On Android, a fake Adobe Flash Player update delivered DroidJack, granting the operator remote access to calls, messages, contacts, camera, and microphone. Website logs left publicly accessible revealed the operators accessing the site from Iranian IP space, including addresses belonging to Rightel, an Iranian mobile carrier, pointing to an Iranian operational nexus.

The SamSam ransomware campaign exploited vulnerabilities in public-facing JBoss application servers, leveraging JexBoss for initial access. The attackers gained a foothold, moved laterally across networks, and deployed SamSam ransomware to encrypt Windows systems. The healthcare sector was a primary target, with ransom demands increasing over time—from 1 BTC per system to 1.7 BTC. Attackers also introduced a bulk decryption option for 22 BTC. REGeorg's tunnel.jsp was used to maintain access. The malware employed Rijndael encryption with RSA-2048 key wrapping, rendering files unrecoverable without payment. The campaign demonstrated a shift from phishing to direct server exploitation, highlighting the evolving nature of ransomware attacks.

During the 2014 Israel-Gaza conflict, an operation themed "protective edge" spear phishing campaign emerged, targeting Israeli entities. The Gholee malware, delivered via a malicious Excel file named ‘Operation Protective Edge.xlsb’, utilized social engineering and VBA macro execution to compromise systems. The malware featured advanced obfuscation and evasion techniques, including ASCII character encoding and debugger detection, to avoid security measures. It communicated with a server in Kuwait, using an outdated SSL certificate, suggesting sophisticated threat actors possibly linked to state-sponsored activities.