Iranian-Linked Group5 Targets Syrian Opposition with Multi-Platform Malware

A threat actor known as Group5 ran a targeted surveillance campaign against members of the Syrian political opposition starting in October 2015. The attackers sent spearphishing emails carrying malicious PowerPoint files and set up a fake website — assadcrimes[.]info — that automatically downloaded malware onto visitors' devices. Victims' Windows computers were infected with remote access trojans (RATs), and their Android phones were targeted with spyware disguised as an Adobe Flash Player update. Citizen Lab researchers uncovered and documented the operation, publishing their findings in August 2016.

A threat actor known as Group5 ran a targeted surveillance campaign against members of the Syrian political opposition starting in October 2015. The attackers sent spearphishing emails carrying malicious PowerPoint files and set up a fake website — assadcrimes[.]info — that automatically downloaded malware onto visitors' devices. Victims' Windows computers were infected with remote access trojans, and their Android phones were targeted with spyware disguised as an Adobe Flash Player update. Citizen Lab researchers uncovered and documented the operation, publishing their findings in August 2016.

The operation was carried out by a group Citizen Lab named "Group5" — the fifth known threat actor targeting Syrian opposition networks. The group shows strong circumstantial links to Iran: operators accessed the watering hole site from Iranian IP addresses (including Rightel, an Iranian mobile carrier), used a Persian-language mailer and crypter (PAC Crypt), and PDB strings in the malware pointed to a developer known as "mr.tekide," an Iranian malware author. No definitive state sponsor was identified, though Iranian state interests were considered likely given the tooling and infrastructure.

The primary goal was surveillance and intelligence collection. Once installed on a victim's device, the malware could steal files, log keystrokes, capture screenshots, record audio and video through the microphone and webcam, and — on Android devices — access call logs, contacts, SMS messages, and location data. This type of access gives an attacker a detailed, real-time picture of a target's communications, plans, and contacts, which is directly useful for monitoring and disrupting opposition activities.

The campaign was narrow and deliberate. Citizen Lab identified only a handful of confirmed targets, with Noura Al-Ameer — a senior Syrian National Council official — being the first named victim. The low antivirus detection rate (only 2 of 16 file hashes flagged on VirusTotal) is consistent with a highly targeted operation designed to fly under the radar. The attackers appear to have been at an early stage of their campaign when discovered, meaning the full intended scope of targeting may have been broader but never fully deployed.

The campaign focused on members of the Syrian political opposition, particularly well-connected figures involved in diplomacy, advocacy, and armed resistance. Human rights defenders, political negotiators, and diaspora activists are the primary at-risk group. The bait content — politically themed slideshows about Iranian crimes and the Syrian conflict — was carefully tailored to appear credible to this audience, showing the attackers had good knowledge of the community they were targeting.

The attack unfolded in two main channels. First, targets received spearphishing emails containing politically themed PowerPoint slideshows; opening the file silently installed Windows malware either through an embedded OLE object triggered by the slideshow animation, or by exploiting CVE-2014-4114, a vulnerability in how Windows handles OLE packages. Second, the attackers maintained a fake website (assadcrimes[.]info) that automatically downloaded malware when visited. Android users who landed on the site were shown a fake Flash Player update prompt; installing it gave the attacker full remote access to their phone. All malware was obfuscated with PAC Crypt to reduce antivirus detection.

Syrian opposition figures hold sensitive strategic and operational intelligence that is highly valuable to state adversaries — information about political negotiations, internal group structures, donor networks, and the locations and plans of armed groups. For an actor with Iranian interests, monitoring the Syrian opposition provides direct insight into the activities of groups that oppose Iranian allies in the conflict, making these targets high-value from an intelligence perspective. The highly networked, socially active nature of the opposition community also means that compromising one device can yield contact lists and communications that enable further targeting.