Earth Simnavaz Targets UAE and Persian Gulf Energy Sector with Advanced Cyber Espionage

Earth Simnavaz, also known as APT34 and OilRig, is a cyber espionage group that primarily targets organizations in the energy sector, specifically those involved in oil and gas, as well as other critical infrastructure. They are known for their sophisticated tactics, techniques, and procedures (TTPs) used to gain unauthorized access to networks and exfiltrate sensitive information. Recently they have been escalating their attacks specifically against infrastructure in the Middle East region.

Earth Simnavaz employs several advanced techniques, including deploying backdoors that leverage Microsoft Exchange servers for credential theft, exploiting vulnerabilities like CVE-2024-30088 for privilege escalation, and using a combination of customized .NET tools, PowerShell scripts, and IIS-based malware to blend their malicious activity with normal network traffic. They also use a dropped password filter policy to intercept and retrieve credentials from domain users, and utilize remote monitoring and management tools like ngrok to maintain persistent control.

The initial point of entry is typically through a web shell uploaded to a vulnerable web server. This web shell allows the attackers to execute PowerShell code and download or upload files, thereby establishing a foothold within the targeted network. This access is then used to download other tools such as ngrok for lateral movement and remote control.

After gaining initial access, Earth Simnavaz exploits the CVE-2024-30088 vulnerability, which is a Windows Kernel Elevation of Privilege vulnerability. They utilize a custom-built exploit binary loaded into memory via the open-source tool Run PE-In-Memory. This allows them to run arbitrary code in the context of the SYSTEM user, effectively escalating their privileges to gain deeper control of the system.

Earth Simnavaz uses multiple methods to maintain persistence. They use a .NET-compiled installer to create a scheduled task, leveraging an xml definition file, to execute a malicious PowerShell script. Additionally, by abusing the password filter policy, they ensure that they can capture and harvest every password from compromised machines, even after the passwords are changed. They also use tools like ngrok to create tunnels to maintain remote access. This persistent access allows them to exfiltrate data, deploy further payloads and launch additional attacks on other targets.

The group exfiltrates stolen data by leveraging compromised Microsoft Exchange servers. They use stolen domain credentials to access the Exchange server, then attach the stolen passwords as email attachments and route the emails through the legitimate Exchange infrastructure. These emails are sent to mail accounts under the attackers' control, ensuring the data is captured discreetly. The exfiltration tool, known as STEALHOOK, is the key tool for this process.

The utilization of ngrok and other RMM tools is significant because they allow Earth Simnavaz to bypass firewalls and network security controls. These tools create secure tunnels between compromised machines and the attackers' servers, allowing for command-and-control communication, data exfiltration, and the deployment of payloads, all while avoiding easy detection. This increases the stealth and effectiveness of their attacks.