Iranian Ajax Security Team Conducts Espionage on U.S. Defense Contractors

FireEye's Operation Saffron Rose report documented the Ajax Security Team — an Iranian hacking group — running a dual-track espionage campaign in late 2013 and early 2014. On one track, they targeted US defense contractors using spearphishing emails impersonating the IEEE Aerospace Conference and fake login pages for Outlook Web Access and VPN portals. On the other, they distributed trojanized versions of anti-censorship software (Psiphon, Ultrasurf) to Iranian users and dissidents inside Iran. Both tracks used the same custom Stealer malware to harvest credentials, log keystrokes, take screenshots, and exfiltrate stolen data to attacker-controlled servers.

The Ajax Security Team was an Iranian hacking group formed around 2010 by members known as "HUrr!c4nE!" (aka k3yv4n) and "Cair3x." The group initially engaged in website defacements and exploit releases on Iranian hacker forums, before becoming increasingly political and transitioning to cyber espionage by late 2013. FireEye directly linked the espionage campaign to "HUrr!c4nE!" through a registration trail: the attack domain aeroconf2014[.]org was initially registered under keyvan.ajaxtm@gmail.com — the same email used to register ajaxtm[.]org, the Ajax Security Team's own website. The group is assessed to have links to Iranian state interests, consistent with the Basij Cyber Council model of recruiting hackers for intelligence operations.

The campaign pursued two parallel goals. Against US defense contractors, the goal was intelligence collection — stealing credentials and sensitive data from companies in the defense industrial base. Against Iranian users, the goal was surveillance and counter-dissidence: by distributing trojanized anti-censorship tools, the group could monitor Iranians who were trying to bypass the government's internet filtering system, identifying activists and dissidents. FireEye recovered data from 77 victims on one C2 server, the majority of whom had Iranian timezone and Persian language settings — confirming the domestic surveillance intent.

The campaign had two distinct target groups. The first was US defense industrial base companies — particularly those connected to the aerospace and defense sectors, targeted through the fake IEEE Aerospace Conference lure and spoofed corporate login pages. The second was Iranian users of anti-censorship software and dissidents — people inside Iran or in the diaspora who were using tools like Psiphon and Ultrasurf to bypass the Iranian government's internet filtering system. These two groups represent very different intelligence priorities: foreign defense intelligence on one side, domestic dissidence monitoring on the other.

The Ajax Security Team used three methods simultaneously. First, spearphishing emails from a fake IEEE Aerospace Conference domain directed defense contractor employees to install "proxy" software — which was actually the Stealer malware. Second, fake Outlook Web Access and VPN login pages tailored to specific defense companies captured real credentials, giving the attackers legitimate network access. Third, trojanized versions of legitimate anti-censorship tools (Psiphon, Ultrasurf, Gerdoovpn, Proxifier) were distributed to Iranian users — the malware was hidden inside the real installer, so users got the working software and the Stealer backdoor simultaneously. All three methods delivered the same Stealer payload, which collected everything from keystrokes and screenshots to browser credentials, IM accounts, and RDP passwords, encrypting it all before sending it to the attackers' FTP servers.

The Stealer malware was a custom-built tool the Ajax Security Team called simply "Stealer." Once installed, it ran silently in the background and collected: system information (hostname, IP addresses, open ports, running processes, installed applications, timezone), keystrokes, periodic screenshots, credentials and history from Chrome, Firefox, Opera, and Internet Explorer, instant messaging account data from GTalk, Pidgin, Yahoo, and Skype, RDP account credentials from the Windows vault, and configuration details from any proxy software installed. All collected data was encrypted locally using AES-256 with a Persian passphrase ("HavijeBaba") before being transmitted to attacker-controlled FTP servers. The use of Persian language words in the encryption key is one of several indicators pointing to the Iranian origins of the malware's developers.

US defense contractors hold sensitive information about weapons programs, military technology, and defense contracts that is directly valuable to Iranian intelligence. The aerospace sector was specifically targeted through the fake IEEE Aerospace Conference lure, suggesting the attackers had good knowledge of which events defense industry professionals attend. Iranian anti-censorship users are targeted for a different reason: the Iranian government actively monitors and suppresses those who circumvent its internet filtering system, viewing them as political threats. By trojanizing popular tools like Psiphon and Ultrasurf, the Ajax Security Team could identify who inside Iran was trying to access blocked content — and by extension, who might be a dissident, activist, or opposition figure worth monitoring.