APT34 Uses Saitama Backdoor to Attack Jordanian Government through DNS Tunnelling
- Actor Motivations: Espionage,Exfiltration
- Attack Vectors: Backdoor,Spear Phishing
- Attack Complexity: High
- Threat Risk: High Impact/Low Probability
Threat Overview
Malwarebytes Threat Intelligence details the complete four-step DNS tunneling state machine used by the Saitama backdoor in APT34's attack on Jordan's Foreign Ministry. The maldoc was an Excel file named "Confirmation Receive Document.xls" — a spearphishing attachment that, when opened, installed Saitama (update.exe) and established persistence via Office template macros. All C2 communication runs over DNS using three interchangeable lookalike domains (uber-asia[.]com, asiaworldremit[.]com, joexpediagroup[.]com). Saitama's key evasion design addresses two DNS-specific problems: unencrypted traffic (solved with message obfuscation) and aggressive caching (solved by incrementing a counter with every request, which generates a unique custom base36 alphabet per message via substitution cipher, ensuring no two DNS queries look the same). The four-stage protocol works as follows: (1) Make Contact — Saitama picks a random counter (0–46655), encodes an initial beacon including the string "aharuto" using the counter-derived alphabet, and receives a unique agent ID in the last octet of the C2's A-record response; (2) Ask for Command — Saitama encodes its agent ID and signals readiness; the C2 responds with the payload size encoded in the final three octets of the IP address (first octet 129–255 acts as a signal byte); (3) Get Command — Saitama retrieves the encoded command, with the first IP octet identifying one of five functions (43=Static, 70=Cmd, 71=CompressedCmd, 95=File, 96=CompressedFile) and remaining octets carrying ASCII command bytes; (4) Run Command — output is chunked into 12-byte segments, individually encoded, and exfiltrated via further DNS queries. The C2 domain is chosen at random from the three root domains at each step, further varying the traffic profile.
Detected Targets
| Type | Description | Confidence |
|---|---|---|
| Case | Foreign Ministry of Jordan Foreign Ministry of Jordan has been targeted by APT34 as the main target. | Verified |
| Sector | Government Agencies and Services The specific organization targeted by the attack was the Jordanian government. | Verified |
| Region | Jordan | Verified |
Extracted IOCs
- asiaworldremit[.]com
- joexpediagroup[.]com
- uber-asia[.]com
- 26884f872f4fae13da21fa2a24c24e963ee1eb66da47e270246d6d9dc7204c2b
- e0872958b8d3824089e5e1cfab03d9d98d22b9bcb294463818d721380075a52d
- 70[.]118.101.114
Tip: 6 related IOCs (1 IP, 3 domain, 0 URL, 0 email, 2 file hash) to this threat have been found.
Overlaps
Source: XJunior - June 2022
Detection (five cases): 26884f872f4fae13da21fa2a24c24e963ee1eb66da47e270246d6d9dc7204c2b, e0872958b8d3824089e5e1cfab03d9d98d22b9bcb294463818d721380075a52d, asiaworldremit[.]com, joexpediagroup[.]com, uber-asia[.]com
Source: SANS - June 2022
Detection (four cases): e0872958b8d3824089e5e1cfab03d9d98d22b9bcb294463818d721380075a52d, asiaworldremit[.]com, joexpediagroup[.]com, uber-asia[.]com
Source: Fortinet - May 2022
Detection (four cases): e0872958b8d3824089e5e1cfab03d9d98d22b9bcb294463818d721380075a52d, asiaworldremit[.]com, joexpediagroup[.]com, uber-asia[.]com
Source: Malwarebytes - May 2022
Detection (five cases): 26884f872f4fae13da21fa2a24c24e963ee1eb66da47e270246d6d9dc7204c2b, e0872958b8d3824089e5e1cfab03d9d98d22b9bcb294463818d721380075a52d, asiaworldremit[.]com, joexpediagroup[.]com, uber-asia[.]com
Hint: Overlaps are extracted automatically by examining the IOCs associated with all indexed threats and actors.
FAQs
Frequently Asked Questions: APT34's Saitama Backdoor and DNS Tunneling Against Jordan
Malwarebytes documented how the Saitama backdoor — used by APT34 against Jordan's Foreign Ministry — uses an unusually sophisticated DNS tunneling design to hide its communications. The article walks through Saitama's full four-step protocol: how the malware makes contact with the attacker's server, how it requests and receives commands, and how it sends stolen data back — all through ordinary-looking DNS queries that are designed to look different every single time.
Saitama is attributed to APT34, an Iranian state-aligned cyberespionage group also known as OilRig. The group has been active since at least 2014 and is known for developing custom malware with sophisticated evasion techniques. Saitama represents one of APT34's more technically refined tools — its counter-based encoding scheme demonstrates deliberate design to defeat DNS-level detection mechanisms.
The goal is espionage. Once installed, Saitama gives APT34 covert remote access to the compromised machine — operators can run commands, collect files, and exfiltrate data, all over DNS. The attack on Jordan's Foreign Ministry targeted sensitive diplomatic communications and government systems of direct intelligence value to Iranian state interests.
The attack targeted a specific official at Jordan's Foreign Ministry, making it a precise spearphishing operation rather than a broad campaign. The maldoc — an Excel file named "Confirmation Receive Document.xls" — was crafted to appear relevant to the recipient. The attack was uncovered in April–May 2022 and is part of a documented pattern of APT34 targeting Jordanian government entities.
The confirmed target was Jordan's Foreign Ministry — the government sector specifically dealing with diplomatic relations and foreign policy. Jordan's strategic position in the Middle East, its relationships with Western allies and Gulf states, and its involvement in regional diplomacy make it a persistent intelligence target for Iranian-linked groups.
The attack started with a spearphishing email carrying a malicious Excel file. Once opened and the macro enabled, Saitama installed itself and persisted via an Office template so it would run each time Office applications started. From there, Saitama communicated through a four-step DNS protocol: it first checked in with the attacker's server using an encoded random counter, received a unique agent ID, then entered a loop of asking for commands and running them. Commands were encoded in the IP addresses returned by DNS — the function type in the first octet, command bytes in the rest. Each DNS request used a freshly generated encoding alphabet derived from an incrementing counter, so every query looked unique and could not be recognized through pattern matching alone.
Jordan's Foreign Ministry represents a high-value intelligence target for Iran — diplomatic communications, personnel contacts, and policy positions held by the ministry are directly relevant to Iran's regional strategy. APT34 consistently prioritizes government and diplomatic organizations in the Middle East that can provide strategic intelligence. The use of a carefully named maldoc ("Confirmation Receive Document") suggests social engineering tailored to a government official's daily workflow.
Block the three known C2 domains — uber-asia[.]com, asiaworldremit[.]com, joexpediagroup[.]com — and the IP 70.118.101.114. Hunt for the maldoc and Saitama binary using the SHA256 hashes published in this report. Disable Office template macros via Group Policy to block Saitama's persistence mechanism. Monitor DNS traffic for long structured subdomain strings queried at regular intervals across the same root domains — Saitama's counter-based encoding produces a consistent query rhythm even though each individual subdomain looks different. Alert on Office applications spawning unexpected child processes or writing to template directories.