Lab Dookhtegan Exposes APT34's Email Hacking Tool: The Silent Threat of 'Jason'

Telsy was among the first to analyze Jason — publishing the same day Lab Dookhtegan leaked it on Telegram. Jason is a .NET graphical tool for brute-forcing Microsoft Exchange email accounts using OAB and EWS methods, with configurable user/password lists and multi-threading. At time of publication, no VirusTotal engine flagged it as malicious. Telsy calls on security vendors to classify such hacking tools as potentially malicious even though the tool itself doesn't directly compromise a system — it's a credential theft enabler.

Jason was leaked by Lab Dookhtegan as part of the APT34 tool exposure on Telegram. Attribution to APT34 rests on the trusted source of the leak. Telsy's concurrent analysis of the same group's MailDropper implant (2020) later confirmed that APT34 used Jason to brute-force Exchange credentials that were then hardcoded into the MailDropper backdoor, providing real-world evidence of Jason being operationally deployed by APT34.

Jason is a credential theft and email harvesting tool. It brute-forces Exchange accounts to obtain valid credentials, which can then be used to access and harvest emails and account information from targeted mailboxes. In APT34's operational chain — as seen in the 2020 Lebanon campaign — the obtained credentials are hardcoded into implants like MailDropper, enabling the malware to use the victim's own government Exchange server as a covert C2 channel.

Telsy confirmed zero VirusTotal detections for Jason.exe at time of publication — a direct consequence of the tool being a GUI brute-force utility rather than malware that deploys a payload or creates persistence. This makes it harder for traditional antivirus to flag as malicious. Telsy's call to action for security vendors to classify such hacking tools as potentially malicious reflects a broader gap in endpoint protection: tools designed for credential theft often evade detection because they don't exhibit traditional malware behaviors.

Jason writes scan results to out-[datetime].txt files and debug/activity logs to log.txt in the working directory. These are forensic artifacts — if an analyst finds either file type in unexpected locations on a system, it may indicate Jason was recently run on that machine. The datetime-stamped output file naming also provides a rough indication of when the tool was used.

The significance is in Jason's role as a precursor tool in a multi-stage attack chain. APT34 uses Jason to obtain Exchange credentials, then hardcodes those credentials into implants like Karkoff and MailDropper. Those implants use the compromised Exchange server as their C2 — routing all attack communications through the victim organization's own email infrastructure. This creates a C2 channel that is effectively invisible: the traffic is encrypted Exchange email originating from a legitimate institutional server, indistinguishable from normal organizational communications without deep Exchange audit log inspection.

The Lab Dookhtegan leaks exposed multiple APT34 tools, operator identities, and victim lists in 2019, causing significant disruption to the group. For defenders, the leaks provided rare visibility into an active Iranian state APT toolkit. Jason's exposure allowed the community to develop YARA rules and detection signatures — within 24 hours of the leak, Telsy had published a detection rule, and Marco Ramilli followed two days later with a 20-string YARA rule. The leaks also gave researchers the context to connect Jason to subsequent APT34 operations against Lebanon's government in 2020.