UNC3890: The Iranian Nexus Behind Attacks on Israeli Shipping and Healthcare

UNC3890, a suspected Iranian-nexus threat actor, conducted a sustained espionage campaign targeting Israeli organizations in the shipping, government, energy, aviation, and healthcare sectors from at least late 2020 through mid-2022. The group used a combination of watering holes, credential-harvesting lookalike websites, fake job offer lures, and social engineering videos to deliver two custom tools — SUGARUSH (a TCP backdoor) and SUGARDUMP (a browser credential stealer) — alongside publicly available frameworks. Mandiant documented and published the campaign in August 2022.

The campaign is attributed to UNC3890, a suspected Iranian-nexus threat actor. Mandiant's attribution is based on multiple converging indicators: the group's exclusive focus on Israeli organizations aligns with other Iranian APT targeting patterns; Farsi language artifacts were found embedded in SUGARDUMP malware code (the word "KHODA" meaning god in an AES encryption key, and a project named "yaal" — horse's mane in Farsi); and a shared PDB file path was identified linking UNC3890 to UNC2448, a group independently assessed as linked to the Iranian Revolutionary Guard Corps (IRGC). At the time of publication, Mandiant had not definitively confirmed formal affiliation with a specific Iranian government body.

The primary goal was intelligence collection — establishing persistent access to Israeli organizations to harvest credentials and gather strategic intelligence. SUGARDUMP's sole purpose is stealing browser credentials from Chrome, Opera, Edge, and Firefox, giving the group access to victim accounts and services far beyond the initial footpoint. SUGARUSH provides a persistent reverse shell for command execution and deeper network access. The group's particular interest in the Israeli shipping sector and its monitoring of naval cargo movements suggests intelligence collection tied to the ongoing maritime conflict between Iran and Israel in this period.

The campaign targeted Israeli organizations across multiple sectors — shipping, government, energy, aviation, and healthcare — all active from at least late 2020 through mid-2022. The group also targeted individuals through fake LinkedIn, Office 365, Facebook, and Pfizer credential-harvesting pages, suggesting individual employees at these organizations were directly targeted for credential theft. Artifacts uploaded to VirusTotal from Israel confirm the geographic focus. The group's particular emphasis on the shipping sector reflects the ongoing Iranian-Israeli maritime shadow conflict during this period.

Israeli shipping companies are of direct strategic interest to Iran given the maritime shadow war between the two countries — Iran has targeted Israeli-linked cargo ships for sabotage, and intelligence on shipping routes, cargo manifests, and naval movements would be operationally valuable. Israeli government and energy organizations hold diplomatic and infrastructure intelligence. Healthcare organizations hold sensitive personal data on Israeli citizens. The group's multi-sector focus suggests a broad intelligence collection mandate rather than a single operational objective, consistent with state-sponsored espionage priorities.

UNC3890 used several initial access methods in parallel. A watering hole was planted on a legitimate Israeli shipping company's login page — when employees visited it, their credentials were silently sent to a Punycode LinkedIn lookalike domain (xn--lirkedin-vkb.com). Spearphishing emails carried fake job offers (including a LexisNexis lure) and a link to a video commercial for robotic dolls that triggered a malicious download. Credential-harvesting pages mimicked LinkedIn, Office 365, Facebook, and Pfizer portals. Once on a victim system, SUGARUSH established a reverse TCP shell to the attacker's C2 on port 4585, while SUGARDUMP collected saved credentials from all major browsers and exfiltrated them either via webmail (Yahoo/Yandex accounts) or AES-encrypted HTTP POST to the C2 server.

SUGARDUMP evolved across three documented versions. The first version (early 2021) extracted browser credentials and stored them locally without any exfiltration capability — likely used for manual collection during active access. The second SMTP version (late 2021) added automated exfiltration via webmail using Yahoo, Yandex, and Gmail accounts under the john.macperson2021 alias, and used a robotic dolls commercial video as a delivery lure. The third HTTP version (April 2022) replaced the webmail exfiltration with AES-CBC encrypted HTTP POST to the attacker's C2 server, added a fake LexisNexis job offer lure, and embedded the Farsi word "KHODA" in the AES encryption key — a Farsi cultural artifact left by the developer. Each version reflects a more operationally mature capability with better OPSEC.