Understanding Saitama: The Latest Weapon in APT34's Cyber Arsenal
- Actor Motivations: Espionage,Exfiltration
- Attack Vectors: Backdoor,Spear Phishing
- Attack Complexity: High
- Threat Risk: High Impact/Low Probability
Threat Overview
Renato Marinho of Morphus Labs (SANS ISC) provides a technical decoder analysis of Saitama's novel DNS tunneling C2 mechanism, complementing the Malwarebytes discovery reports. Saitama's key innovation is encoding attacker commands directly inside IPv4 address octets returned by the C2 nameserver — rather than using DNS TXT records or other large-payload record types. The first octet carries a control code (indicating whether a command or payload is being issued), and the subsequent three octets encode three ASCII characters of the command. For example, to issue 'whoami', the server returns two IPs: 70.119.104.111 (control byte 70; w=119, h=104, o=111) and 97.109.105.49 (control byte 97; a=109, m=105, i=49). This approach makes commands indistinguishable from ordinary A-record DNS responses in environments that do not inspect IPv4 address content. Data exfiltration flows in the opposite direction: the victim encodes command output in chunked subdomain strings of attacker-controlled domains (joexpediagroup[.]com, uber-asia[.]com), reassembled by the C2. Marinho captured a live 'ver' exfiltration session reconstructing "Microsoft Windows [Version 10.0.18363.418]" across four DNS queries. The Saitama binary is a .NET assembly that can be readily decompiled, and Morphus Labs released an open-source decoder tool (saitama_translator) on GitHub to help defenders translate captured DNS sessions from infected hosts. The author notes the accessibility of Saitama's implementation could encourage other threat actors to adopt similar IPv4-encoding DNS tunneling techniques.
Detected Targets
| Type | Description | Confidence |
|---|---|---|
| Case | Foreign Ministry of Jordan Foreign Ministry of Jordan has been targeted by APT34 as the main target. | Verified |
| Sector | Government Agencies and Services The attack was specifically targeted at a government official from Jordan’s foreign ministry. | Verified |
| Region | Jordan | Verified |
Extracted IOCs
- asiaworldremit[.]com
- joexpediagroup[.]com
- uber-asia[.]com
- e0872958b8d3824089e5e1cfab03d9d98d22b9bcb294463818d721380075a52d
- 70[.]119.104.111
- 97[.]109.105.49
Tip: 6 related IOCs (2 IP, 3 domain, 0 URL, 0 email, 1 file hash) to this threat have been found.
Overlaps
Source: XJunior - June 2022
Detection (four cases): e0872958b8d3824089e5e1cfab03d9d98d22b9bcb294463818d721380075a52d, asiaworldremit[.]com, joexpediagroup[.]com, uber-asia[.]com
Source: Malwarebytes - May 2022
Detection (four cases): e0872958b8d3824089e5e1cfab03d9d98d22b9bcb294463818d721380075a52d, asiaworldremit[.]com, joexpediagroup[.]com, uber-asia[.]com
Source: Fortinet - May 2022
Detection (four cases): e0872958b8d3824089e5e1cfab03d9d98d22b9bcb294463818d721380075a52d, asiaworldremit[.]com, joexpediagroup[.]com, uber-asia[.]com
Source: Malwarebytes - May 2022
Detection (four cases): e0872958b8d3824089e5e1cfab03d9d98d22b9bcb294463818d721380075a52d, asiaworldremit[.]com, joexpediagroup[.]com, uber-asia[.]com
Hint: Overlaps are extracted automatically by examining the IOCs associated with all indexed threats and actors.
FAQs
Frequently Asked Questions: APT34's Saitama Backdoor — IPv4-Encoded DNS Tunneling
Morphus Labs published a technical analysis of Saitama — a backdoor used by Iran-linked APT34 against Jordan's Foreign Ministry — focusing on the malware's unusual method of hiding commands inside ordinary-looking DNS responses. Where most DNS-tunneling malware encodes data in TXT records or subdomain strings, Saitama encodes attacker commands directly in the IPv4 address octets returned by its C2 server, making traffic appear to be routine A-record DNS lookups. Morphus Labs also released an open-source tool to decode captured Saitama DNS sessions.
Saitama is attributed to APT34, also known as OilRig — an Iranian state-aligned cyberespionage group. The attribution is based on phishing email analysis and malware characteristics documented by Malwarebytes, which Morphus Labs builds on. APT34 has a long history of targeting government organizations across the Middle East using custom DNS-tunneling backdoors, of which Saitama is one of the most technically novel examples.
The goal is espionage. Saitama gives attackers persistent remote access to a compromised government machine — they can issue commands and receive the output covertly over DNS, a channel that most organizations do not inspect in depth. The live session captured by Morphus Labs showed the attacker running reconnaissance commands (whoami, ver) consistent with early-stage access and victim profiling rather than any immediate destructive action.
The confirmed target was a government official at Jordan's Foreign Ministry. The attack was highly targeted — a single spearphishing email sent to a specific individual — rather than a broad campaign. The Morphus Labs decoder recovered a live session confirming the victim ran Windows 10, consistent with a standard government workstation environment.
The confirmed victim was Jordan's Foreign Ministry — specifically a government official targeted via spearphishing. Jordan's diplomatic communications and foreign policy positions represent high-value intelligence for Iranian state interests, particularly given Jordan's relationships with Israel, the US, and Gulf states. Government ministries handling foreign affairs are consistent priority targets for APT34's espionage mandate.
A spearphishing email with a malicious Excel attachment was sent to a Jordanian Foreign Ministry official. Opening the attachment triggered a macro that installed Saitama and set it to run persistently via an Office template. Once active, Saitama communicated with attacker-controlled DNS servers exclusively through A-record lookups — encoding commands in the IPv4 addresses returned. For example, to send 'whoami', the server returned IPs where the non-control octets spelled out the ASCII codes of w, h, o, a, m, i. The victim's machine sent output back by embedding it in chunked subdomain strings across multiple DNS queries to domains mimicking Expedia, Uber, and WorldRemit.
Jordan's Foreign Ministry handles sensitive diplomatic communications, bilateral agreements, and foreign policy decisions — all of direct intelligence value to Iran. Jordan's position as a relatively moderate Arab state with ties to both Western governments and Gulf partners makes it a persistent target for Iranian intelligence collection. The use of lookalike domains mimicking global travel and financial brands (Expedia, Uber, WorldRemit) suggests the attacker anticipated that DNS traffic to such domains would not raise alarms in a government network environment.
Use the open-source saitama_translator tool (github.com/morphuslabs/saitama_translator) to decode DNS captures from suspected Saitama infections — it reconstructs commands and exfiltrated data from raw FQDN logs. Block the known C2 domains and IPs in the IOC bundle. Implement DNS inspection that flags A-record responses with unusual IPv4 patterns — particularly high-frequency lookups to the same domain returning IPs with first octets in ranges consistent with Saitama's control byte scheme. Disable Office Template Macros (Normal.dotm) to block the persistence mechanism. Apply strict email filtering with attachment sandboxing to catch the Excel macro delivery before it reaches the endpoint.