New APT34 Malware Variant Abuses Exchange Servers for Data Exfiltration

In December 2022, Trend Micro identified a targeted cyberespionage campaign by APT34 against government organizations in the Middle East. The attackers deployed a custom malware package that stole user credentials — including newly changed passwords — and quietly exfiltrated sensitive files through the victims' own government email servers, making the malicious traffic blend in with normal internal mail.

The attack was carried out by APT34, an Iranian state-sponsored hacking group also known as OilRig or Helix Kitten. Active since at least 2014, APT34 is believed to operate in support of Iran's intelligence objectives, with a long history of targeting governments, financial institutions, energy companies, and telecoms across the Middle East. Trend Micro attributed this campaign to APT34 based on code similarities to prior tools (Saitama and Karkoff), overlapping infrastructure, and consistent targeting of Middle Eastern government entities.

The campaign was a credential theft and cyberespionage operation. APT34's goal was to steal user passwords — including any new passwords set after a reset — and exfiltrate sensitive files from government networks. The attack was designed to maintain persistent, covert access to government systems and communications, with strong indicators that this was part of a larger ongoing campaign against Middle Eastern government infrastructure rather than a one-off intrusion.

The campaign targeted government entities across the Middle East. Evidence from the malware samples — including hardcoded government Exchange server domains and compromised accounts found across multiple agencies — suggests the attackers had already penetrated a shared Active Directory domain forest used by several government ministries. This indicates the operation's true scope extended well beyond a single organization. APT34's historically documented top targets include the UAE, Jordan, Saudi Arabia, and a broader set of Middle Eastern countries including Qatar, Oman, Kuwait, and Bahrain.

The primary targets were government agencies and ministries in the Middle East. APT34 has a documented history of also targeting financial institutions, energy companies, chemical industries, and telecommunications providers in the region. This particular campaign was focused on the government sector, where the attackers abused internal email infrastructure — specifically Microsoft Exchange servers used by government ministries — as both a data relay and an exfiltration channel.

The attackers deployed a .NET dropper on target machines that silently installed three malicious components: a Password Filter DLL registered into Windows' authentication system to capture every plaintext password typed during a password change, a backdoor that used stolen credentials to log into the victim's Exchange email server, and supporting libraries. The backdoor then scanned a designated folder for files, packaged them as email attachments with a generic subject line to avoid suspicion, and sent them through the compromised government mailbox to six external email addresses controlled by the attackers. Because the outbound traffic looked like ordinary internal email, it was difficult for security teams to distinguish from legitimate activity.

Government organizations in the Middle East hold sensitive diplomatic, military, and economic intelligence that is highly valuable to Iranian state interests. APT34 has consistently targeted this sector for over a decade. Government Exchange servers are particularly attractive because they serve as trusted communication hubs across multiple agencies — once compromised, they provide both a rich source of intelligence and a built-in exfiltration channel that is hard to detect. The shared Active Directory trust relationships between government ministries also mean a foothold in one agency can be leveraged to access others.