Credential and Information Theft: APT33's Job Scam Campaign
- Actor Motivations: Espionage
- Attack Vectors: Backdoor,Phishing
- Attack Complexity: Low
- Threat Risk: Low Impact/High Probability
Threat Overview
Iranian APT33 has been detected running a phishing campaign that employs fake job scams to lure victims. The campaign aims for credential theft, information theft, and unauthorized remote access. While the targeted sectors and countries are not specified, the indicators of compromise involve domain names like "www[.]global-careers[.]org" and filenames such as "JobDescription.zip" and "JobDescription.vbe".
Extracted IOCs
- fineksus[.]com
- global-careers[.]org
- dyn-intl.world-careers[.]org
- raytheonjobs.serveblog[.]net
- www.global-careers[.]org
- 0efb36b6dd3493b7869e8da731eff77d
- 24ccad79498d240f19bfd2fc144b875e
- 673510dd92eb812d70b017c27385d389
- 7c295c528fea9385a2e3165b683d1a46
- af707c4f8e40f529e8a342259ee9c8ae
- 14985711a5aa14c6cded0f21db544706ba845de89866e06c59a9151e7dafe19f
- 6d76db96a544700a1fdcac810c7429aa64c22f249895d0a6e58d44809350fa69
- 92e66acd62dfb1632f6e4ccb90a343cb8b8e2f4fb7c9bfa9ae0745db0748223b
- ce0f7048903c6c2ee5357e8678247ae19666e91058060a3d38e09e49a94047b7
- e2b5900211088daf754d900ff7b229defe72bf6ae21efb53c966113a2b2b16b3
- 208[.]91.197.91
- hxxp://fineksus[.]com/delp.exe
Tip: 17 related IOCs (1 IP, 5 domain, 1 URL, 0 email, 10 file hash) to this threat have been found.
About Affiliation
APT33
APT33 is an Iranian state-sponsored threat actor active since at least 2013, assessed by Mandiant to work at the behest of the Iranian government. The group focuses primarily on cyber espionage against organizations in the aerospace, aviation, energy, and defense sectors across the United States, Saudi Arabia, South Korea, and other countries. APT33 is known for spear phishing campaigns using job-recruitment lures and malicious .hta files, large-scale password spray operations, and the use of destructive malware. Microsoft tracks this cluster as Peach Sandstorm and previously as HOLMIUM.
View APT33's Insights