Greenbug Group's Escalated Threat: Ismdoor RAT's Role in the Shamoon Attacks

NETSCOUT documented a major upgrade to Ismdoor, a custom spying tool used by the Iranian-linked Greenbug group to target Saudi Arabian companies. The newer versions of Ismdoor abandoned standard HTTP communications in favor of a hidden channel that tunnels all activity through normal-looking DNS queries — making it much harder to detect on the network. Separately, security researchers suspect Greenbug used Ismdoor to steal credentials from Saudi organizations before those credentials were used in the destructive Shamoon disk-wiping attacks, though a definitive link remains unconfirmed.

The attacks are attributed to Greenbug, a cyberespionage group assessed to be linked to the Iranian state. Greenbug has been active since at least 2016 and focuses on targets in the Middle East, particularly Saudi Arabia. The group is notable for developing its own custom malware rather than relying on off-the-shelf tools, and for continuously updating Ismdoor with new capabilities — including the DNS tunneling channel documented in this report.

Greenbug's primary goal with Ismdoor is espionage and credential theft. The RAT gives operators full remote access to compromised systems — they can steal files, capture screenshots, log keystrokes, dump Windows credentials using Mimikatz, and run arbitrary commands. The suspected downstream goal of this credential theft is to enable the Shamoon/Disttrack destructive attacks: the stolen credentials are believed to have been used to spread Disttrack across Saudi networks and trigger disk-wiping operations. If confirmed, Ismdoor functioned as the reconnaissance and access phase before a destructive payload was deployed.

All known DNS-variant Ismdoor samples were submitted to VirusTotal from Saudi Arabia, and the Shamoon campaigns it is suspected of enabling exclusively targeted Saudi Arabian companies. The campaign spans from at least mid-2016 through early 2017, with Ismdoor actively developed and updated throughout that period. Symantec confirmed Ismdoor's presence on at least one Shamoon-targeted organization's network prior to the November 2016 Disttrack deployment.

Greenbug targets Saudi Arabian organizations, with a particular focus on companies and sectors that were also targeted by the Shamoon attacks — including energy and critical infrastructure. The source does not identify specific victim organizations, but the targeting pattern is consistent with Iranian state interest in disrupting Saudi economic infrastructure and gathering intelligence on high-value Saudi entities.

Ismdoor gains a foothold on target systems and then communicates with attacker-controlled servers entirely through DNS — specifically through lookup requests for IPv6 addresses. Commands and data are encoded in the subdomain portion of these requests, and responses are embedded in the IPv6 addresses returned. This makes the traffic blend in with normal DNS activity on the network. Once connected, operators can execute over 20 commands: stealing credentials with Mimikatz, logging keystrokes, capturing screenshots, opening network tunnels with Powercat, bypassing Windows security controls, and uploading or downloading files. The malware updates its own configuration and code remotely and can remove itself when instructed.

Saudi Arabian organizations — particularly in energy and critical infrastructure — are high-value targets for Iran. Iran and Saudi Arabia have longstanding geopolitical and sectarian tensions, and disrupting Saudi industry serves Iranian strategic interests. The suspected link to Shamoon suggests Greenbug's espionage phase was not just about intelligence collection but about enabling follow-on destructive attacks designed to cause significant operational damage to the Saudi economy.