The Possible Connection Between Greenbug and Shamoon Revealed

A cyber espionage group called Greenbug, active since at least June 2016, ran a sustained campaign against organizations in the Middle East using a custom remote access Trojan called ISMdoor. The group targeted sectors including aviation, energy, government, investment, and education. Symantec's investigation found that Greenbug's activity on at least one compromised network stopped a day before a destructive Shamoon wiper attack hit the same organization in November 2016, raising the possibility that Greenbug had passed stolen credentials to the Shamoon attackers.

The espionage campaign was carried out by Greenbug, an Iranian-linked cyber espionage group. Symantec assessed Greenbug as a distinct actor but noted infrastructure overlaps and a suspicious timing correlation with the Shamoon group, which is also believed to have Iranian connections. The exact relationship between the two groups — whether they are the same, affiliated, or simply sharing resources — has not been definitively confirmed.

Greenbug's primary goal was espionage — gaining persistent access to targeted organizations, collecting sensitive data, and harvesting credentials. The suspected link to Shamoon suggests a secondary purpose: feeding stolen credentials to a separate group to enable destructive, follow-on attacks. This two-stage model — espionage first, destruction second — makes Greenbug particularly dangerous for organizations in critical sectors.

Greenbug's campaign was primarily focused on the Middle East, with confirmed targets in Saudi Arabia, Iran, Bahrain, Iraq, Qatar, Kuwait, and Turkey. A Saudi organization operating in Australia was also targeted, showing the group's willingness to follow targets beyond the region. The campaign ran from at least June 2016 through November 2016, spanning multiple countries and industries over several months.

Greenbug targeted organizations in the aviation, energy, government, investment, and education sectors, primarily in the Middle East. Energy and government entities appear to be the highest-priority targets, consistent with Iranian state interests in monitoring regional rivals and critical infrastructure operators. The targeting of a Saudi organization in Australia also shows the group tracks specific entities regardless of their physical location.

Greenbug sent targeted spear phishing emails containing RAR archives with malicious .chm (Compiled HTML Help) files. When a recipient opened the file, ISMdoor was silently installed, opening a backdoor and beginning data collection. The group then used credential harvesting and keylogging tools to steal account credentials from the compromised environment. In at least one case, Greenbug's access to a network appeared to be handed off — with stolen credentials likely used by the Shamoon operators to deploy a destructive wiper days later.

Energy companies, government agencies, and aviation firms in the Middle East hold strategic and economic intelligence of high value to Iranian state interests — including infrastructure vulnerabilities, procurement data, and personnel information. These organizations also tend to hold valid domain credentials and have broad internal network access, making them useful entry points for a follow-on destructive attack. Saudi Arabia in particular has been a recurring target given its geopolitical rivalry with Iran.