DNSPIONAGE: Unpacking Advanced Spear Phishing and Lateral Movement Techniques

In late 2018, CERT-OPMD responded to a live intrusion involving the DNSpionage malware — a backdoor previously documented by Cisco Talos as targeting organizations in Lebanon and the UAE. Their report focused on what happened after the initial infection: how the attackers moved through the network, stole credentials, and exfiltrated data. The attackers used a multi-week LinkedIn social engineering campaign to trick employees into opening a malicious document, then used the resulting access to systematically map and compromise internal systems.

Definitive attribution was not established in this report. Cisco Talos, who originally documented the DNSpionage campaign, did not attribute it to a specific group. However, Mandiant subsequently linked the broader DNSpionage activity to APT34 — an Iranian state-sponsored group — based on overlapping infrastructure and targeting patterns. The heavy focus on Lebanon, the UAE, and energy sector companies is consistent with Iranian intelligence interests in the region.

The campaign was a cyberespionage and data exfiltration operation. The attackers' goal was to gain deep, persistent access to target networks and steal sensitive data — including file system contents, credentials, and network configuration information. The dual-mode command-and-control design (HTTP and DNS tunneling) and the careful use of legitimate-looking tools suggest the operation was intended to remain undetected for as long as possible while maximizing intelligence collection.

The broader DNSpionage campaign targeted organizations in Lebanon and the UAE, with two fake recruitment domains — hr-wipro[.]com and hr-suncor[.]com — used to impersonate real companies (Wipro, an IT services giant, and Suncor Energy). This specific incident involved a confirmed victim organization where CERT-OPMD performed the response. The attackers demonstrated the intent and capability to move laterally across an entire internal network, accessing multiple servers including database systems, suggesting the goal was broad network compromise rather than a single target.

The lure documents impersonated two major companies: Wipro (a global IT services firm) and Suncor Energy (a major Canadian oil and gas company), suggesting the attackers targeted employees in IT and energy sectors. The Cisco Talos report identified government entities in Lebanon and the UAE as primary targets of the broader campaign. This matches APT34's known targeting pattern — government agencies, energy companies, and IT service providers across the Middle East.

The attack began with a LinkedIn social engineering campaign: an attacker posing as a Wipro HR recruiter engaged target employees for several days before sending a malicious Word document link. Opening the document triggered a macro that installed the DNSpionage backdoor as a scheduled task. Once inside, the attackers ran batch scripts to map all drives and directories, used WMIC to execute Mimikatz remotely for credential dumping, and copied Plink (a command-line SSH client) to multiple machines to create encrypted tunnels back to their servers — giving them hidden RDP access to internal systems. All stolen data was sent back through either HTTP requests or covert DNS queries encoded in Base32, disguised as normal traffic.

IT service providers like Wipro are attractive targets because compromising them can give attackers access to the networks of all their customers — a supply-chain style leverage point. Energy companies like Suncor hold commercially and strategically sensitive data. Government entities in Lebanon and the UAE possess diplomatic and intelligence information of direct value to Iranian state interests. Using these company names as lures also increases the chance that employees in relevant roles will trust and open the malicious documents.