APT34 Strikes Again: Government Sector in Lebanon Under Karkoff Attack
- Actor Motivations: Espionage,Exfiltration
- Attack Vectors: Vulnerability Exploitation,Backdoor,Spear Phishing
- Attack Complexity: High
- Threat Risk: High Impact/Low Probability
Threat Overview
Yoroi (Cybaze ZLab) identifies an updated Karkoff implant used by APT34 in a new espionage campaign targeting the Lebanon government, active from at least January 27, 2020 — the date godoycrus[.]com was registered. The campaign connects to a 2018–2019 chain: Cisco Talos had documented the original DNSEspionage campaign against Lebanon and UAE, then in April 2019 linked it to APT34 and named the implant Karkoff. This 2020 variant introduces two key changes. First, it implements a reconnaissance guardrail: before dropping the final payload, Karkoff collects the hostname, domain name, and OS version and only proceeds if the target matches a specific profile — significantly reducing exposure to sandbox and automated analysis environments. Second, the C2 channel runs entirely through a compromised Lebanon government Microsoft Exchange server: Karkoff connects using an Exchange client UserAgent string, retrieves commands delivered as email attachments in replied messages, and decodes them from a custom-encoded email body string. Delivery begins with a malicious Excel macro (hash: 926e29f9...) that extracts a base64-encoded payload from the file body, decodes it, writes monitor.exe to C:\Users\public\.Monitor\, and establishes persistence via a scheduled task named SystemExchangeService. Yoroi assesses APT34 likely used the Jason brute-force tool — leaked in late 2019 and part of the Lab Dookhtegan APT34 tool dump — to obtain Exchange credentials before deploying Karkoff. Telsy published a parallel analysis of the same sample on the same day. Yoroi provides two YARA rules for detection: Karkoff_Attack_2020_Excel_macro (matching EncodedData0, NewTask9 strings) and Karkoff_Campaign_2020 (matching SystemExchangeService, getWindowsVersion, GetCommands). Source URL is no longer directly accessible; this analysis is based on the archived PDF attachment.
Detected Targets
| Type | Description | Confidence |
|---|---|---|
| Sector | Government Agencies and Services | Verified |
| Region | Lebanon | Verified |
Extracted IOCs
- godoycrus[.]com
- 1b2c5354eb567132a341c1b15ad5cc71c3f5ba8e2788b67c0fbc0e7993beb1d2
- 26995a1cd99a5c70fd7bfa925cb0bbbdbd419bedc2d664dffd3b7c57ad07de66
- 59cbc7e788425120c2dde50f037afbf3b1d2108c0b7e27540e924cad2463fe5b
- 678d59bcd469e4cf236c7af7517c54ab9ad643523383875bd875131d7130941f
- 926e29f9242feb3e11c532616f7c90c5d7acab115d38ebf748cabaaa6a2a3667
- ebae23be2e24139245cc32ceda4b05c77ba393442482109cc69a6cecc6ad1393
Tip: 7 related IOCs (0 IP, 1 domain, 0 URL, 0 email, 6 file hash) to this threat have been found.
Overlaps
Source: Telsy - March 2020
Detection (two cases): ebae23be2e24139245cc32ceda4b05c77ba393442482109cc69a6cecc6ad1393, godoycrus[.]com
Hint: Overlaps are extracted automatically by examining the IOCs associated with all indexed threats and actors.
FAQs
Frequently Asked Questions: APT34's Karkoff 2020 — Targeting Lebanon's Government
Yoroi's Cybaze ZLab discovered an updated version of Karkoff — a backdoor linked to APT34 — being used in a new espionage campaign against Lebanon's government. The new variant introduced two significant upgrades: a reconnaissance check that prevents the malware from running on systems that don't match a specific target profile, and a covert C2 channel that runs entirely through a compromised Lebanon government Exchange email server, making attacker traffic blend in with legitimate email activity.
The attack is attributed to APT34, also known as OilRig or Helix Kitten — an Iranian state-linked cyberespionage group active since at least 2014. The Karkoff implant was first tied to APT34 by Cisco Talos in April 2019, when they connected it to the 2018 DNSEspionage campaign against Lebanon and UAE. This 2020 variant was discovered when Yoroi identified a new sample consistent with APT34's TTPs, and Telsy independently reached the same conclusion on the same day.
The campaign was focused on espionage against Lebanon's government. Karkoff collects system information and establishes persistent backdoor access, allowing APT34 operators to run commands on compromised machines and exfiltrate data covertly over the Exchange channel. The use of a compromised government Exchange server as the C2 — rather than attacker-owned infrastructure — makes the traffic significantly harder to detect and block.
The campaign targeted Lebanon's government sector, continuing APT34's documented pattern of operations against Lebanon dating back to the 2018 DNSEspionage campaign. The C2 domain godoycrus[.]com was registered on January 27, 2020, suggesting the operation began that month. The monitor.exe payload was compiled on February 29, 2020. The reconnaissance guardrail designed into the malware — checking hostname, domain, and OS before proceeding — confirms these were narrowly targeted deployments, not broad infection attempts.
All confirmed targets were Lebanon government entities. APT34 has specifically and repeatedly targeted Lebanese government infrastructure since at least 2018 — the original DNSEspionage campaign redirected DNS traffic from Lebanese government domains, and this 2020 Karkoff campaign reused a compromised Lebanon government Exchange server as its own C2 infrastructure. The group's consistent focus on Lebanon reflects Iranian intelligence interest in Lebanese political and government affairs.
APT34 first used the Jason brute-force tool (part of the 2019 tool leak) to gain credentials for a Lebanon government Exchange email server. They then used those credentials to set up the compromised server as their C2. A malicious Excel document was delivered to targets — likely via email — containing a VBA macro that decoded a base64 payload from the file and dropped monitor.exe into a hidden folder at C:\Users\public\.Monitor\. A scheduled task named "SystemExchangeService" ensured persistence. Once running, Karkoff first checked the target's hostname, domain, and OS. If the system matched its target profile, it connected to the compromised Exchange server and retrieved commands encoded in email attachments, executing them silently and sending results back through the same channel.
Lebanon's government is strategically significant to Iran for several reasons: Lebanon's political landscape, including Hezbollah's role in Lebanese politics, is a direct concern for Iranian foreign policy; Lebanon's relationships with Western powers, the UN, and regional actors make its government communications valuable intelligence; and Lebanon's exchange of diplomatic communications with Gulf states and the broader Arab world provides insight into regional political dynamics. APT34 has repeatedly returned to Lebanon as a target, suggesting sustained intelligence-collection requirements against this government.
Deploy the two YARA rules from Yoroi — Karkoff_Attack_2020_Excel_macro (targeting EncodedData0 and NewTask9 strings in the macro) and Karkoff_Campaign_2020 (targeting SystemExchangeService, getWindowsVersion, GetCommands in the binary). Hunt for monitor.exe in C:\Users\public\.Monitor\ and for scheduled tasks named SystemExchangeService. Audit Exchange server logs for external connections using Exchange client UserAgent strings from unexpected source IPs — this is how APT34 accessed the compromised C2 server. Enforce MFA on all Exchange accounts and monitor for brute-force login attempts, which is how initial Exchange access was likely obtained. Block and hunt for godoycrus[.]com and the published file hashes.