APT34 Targets Jordan's Government with Saitama Backdoor: A New Wave of Cyber Espionage

On April 26, 2022, Malwarebytes discovered a spearphishing email targeting a government official at Jordan's Foreign Ministry. The email came from a Microsoft Outlook account impersonating a Jordanian government contact, using the national coat of arms as a signature. The Excel attachment contained a macro that installed a new backdoor called Saitama — written by APT34, an Iranian state-aligned threat group. What made the discovery particularly significant was finding internal Jordanian government IP addresses and internal domain names hardcoded into the malware, proving the attackers had prior knowledge of the victim's network infrastructure.

The attack is attributed to APT34, also known as OilRig, COBALT GYPSY, or HELIX KITTEN — an Iranian threat group active since at least 2014. Malwarebytes bases the attribution on three factors: the maldoc shares behavioral patterns with prior APT34 campaigns (same anti-sandbox technique, same ENotif beaconing pattern documented by Check Point); Jordan's government is a known APT34 target; and Saitama's DNS C2 with Base32/Base36 encoding matches APT34 tools documented by Mandiant and Cisco Talos, including DNSpionage.

The goal is espionage. Saitama gives APT34 persistent, covert access to a compromised government machine — allowing remote command execution and data exfiltration over DNS. The hardcoded internal network commands suggest the attackers planned to conduct reconnaissance of Jordan's Foreign Ministry network before extracting sensitive information. APT34 is known to focus on government, financial, energy, chemical, and telecommunications sectors across the Middle East.

The attack targeted a specific government official at Jordan's Foreign Ministry — a single, high-value individual selected through prior reconnaissance. The hardcoded internal IP addresses and internal domain names in Saitama's command list confirm the attacker performed detailed pre-attack research on the target network before deploying the malware. This was not a mass campaign — it was a precision operation against a single diplomatic target.

The confirmed target was Jordan's Foreign Ministry — specifically a government official in the diplomatic sector. APT34 is documented to have targeted Jordan's government in prior campaigns. Jordan's diplomatic role in the Middle East and its relationships with Western and Gulf partners make its Foreign Ministry a persistent intelligence target for Iranian state interests.

The victim received a spearphishing email impersonating a Jordanian government official. Opening the Excel attachment and enabling the macro triggered a chain of events: the macro first beaconed its execution steps to the C2 using Windows Management Instrumentation (a system administration tool) rather than direct DNS calls — an unusual evasion technique. It checked for a connected mouse before proceeding (an anti-sandbox measure), then wrote three payload files to disk and set up a scheduled task called "MicrosoftUpdate" to run the Saitama backdoor every time the machine started. Saitama then communicated with APT34's servers exclusively over DNS, cycling through states of waiting, requesting commands, executing them, and sending results back — with sleep periods of up to 6–8 hours between failed connection attempts to avoid detection.

Jordan's Foreign Ministry handles diplomatic communications of direct value to Iranian intelligence — including relations with Israel, the US, Saudi Arabia, and other Gulf states. APT34 has a documented history of targeting Jordan's government. The presence of hardcoded internal network addresses in Saitama suggests the attackers already had some level of knowledge about the ministry's infrastructure before this specific attack, implying an ongoing intelligence interest rather than opportunistic targeting.