Unveiling APT34’s Advanced Attack Tactics: From Excel Macros to DNS Tunneling

FortiGuard Labs discovered a sophisticated spearphishing campaign targeting a Jordanian diplomat. The attacker impersonated a real IT department colleague from the same organization — using the employee's actual name — and attached a malicious Excel file containing a confirmation form. The file installed the Saitama backdoor, which communicated exclusively over DNS and used several techniques not seen in typical malware: anti-analysis tricks, real-time state monitoring of the attack via DNS, and a list of commands pre-loaded with internal Jordanian government network addresses. Fortinet attributes the campaign to APT34 based on TTPs, targeting history, and shared infrastructure.

The attack is attributed to APT34, also known as OilRig or Helix Kitten — an Iranian state-aligned cyberespionage group active since at least 2014. Fortinet's attribution rests on the DNS tunneling C2 approach consistent with prior APT34 tools, the Base32 exfiltration encoding matching APT34's DNSpionage malware, the hardcoded internal network knowledge consistent with prior APT34 Jordan operations, and the C2 infrastructure sharing historical connections with documented APT34 activity.

The goal was espionage — specifically collecting sensitive information from a compromised Jordanian government machine. The Saitama backdoor's 22 hardcoded commands, many of which target internal government IP ranges and domain names, show this was not casual reconnaissance but a targeted operation against a specific known network. Fortinet also notes that the 6–8 hour sleep period appears deliberately timed for a diplomat's workday — suggesting the attackers planned to operate overnight after the victim left the office.

The attack was precision-targeted at a single Jordanian diplomat. Fortinet's telemetry confirmed active connections from Jordan to the C2 IP 45.11.19.47 associated with joexpediagroup[.]com. The hardcoded internal network commands in the backdoor indicate the attacker had prior knowledge of the target's internal infrastructure — likely from a limited earlier access point — before launching this spearphishing attempt. The attacker also carefully managed their C2 servers, taking two of the three domains offline shortly after the initial compromise window, suggesting tight operational control.

The confirmed target was a diplomat in Jordan's government — based on Fortinet's characterization and the sender's impersonation of an IT department colleague in the same governmental organization. APT34 has a documented history of targeting Jordanian government entities. The attack is part of a broader pattern of APT34 espionage operations against Middle Eastern government, financial, energy, and telecommunications sectors.

The attack began with a carefully crafted spearphishing email using a real IT employee's name. Opening the Excel attachment and enabling the macro triggered a sequence the attacker could monitor in real time through DNS — the macro beaconed each of nine execution steps using unique subdomain prefixes over WMI queries. The macro verified a mouse was connected before proceeding, decoded three files from base64 captions embedded in hidden form objects, and set up a scheduled task running every 4 hours for 20 days. The installed Saitama backdoor then connected to attacker-controlled servers via DNS, sleeping up to 6–8 hours between contact attempts and cycling through a state machine to receive commands encoded in DNS response IP octets. Results were compressed, Base32-encoded, and exfiltrated back via DNS subdomain strings.

Jordanian government officials represent high-value intelligence targets for Iran. Jordan's diplomatic relationships with Israel, the US, Saudi Arabia, and other Western partners make its foreign policy communications strategically important to Iranian intelligence. The insider-impersonation lure (using a real IT colleague's identity) suggests the attacker had already gathered organizational information before launching the attack — raising the likelihood that this was part of a sustained, multi-stage campaign rather than an isolated opportunistic attempt.