APT34's Enhanced Cyber Espionage: BONDUPDATER and POWRUNER Malware Variants Unveiled

Booz Allen's DarkLabs Threat Hunt team discovered seven previously unreported samples of APT34's BONDUPDATER and POWRUNER malware by pivoting from indicators published in FireEye's December 2017 report and a ClearSky tip from January 2018. The analysis revealed multiple variants of these two tools, confirmed additional attacker-controlled infrastructure, documented the malware's domain generation algorithm for the first time, and produced detection signatures including a YARA rule for the dropper binaries.

The malware is attributed to APT34 (also known as OilRig), an Iranian state-aligned cyberespionage group active since at least 2014. The attribution rests on shared C2 infrastructure with previously documented APT34 operations, identical debug strings across all variant binaries, and the same POWRUNER and BONDUPDATER codebases first reported by FireEye. Both Booz Allen and FireEye independently link these tools to Iranian-linked espionage activity targeting Middle Eastern organizations.

The goal is espionage. POWRUNER gives operators persistent remote access to compromised machines — they can run arbitrary commands and exfiltrate data over TCP. BONDUPDATER acts as a downloader that uses DNS-based communication to pull down additional payloads or instructions, making the C2 channel harder to detect and block. Together the two tools provide APT34 with a durable, covert foothold in targeted networks.

Booz Allen's report does not identify specific victim organizations. The broader FireEye and ClearSky reporting it builds on places the campaign in the Middle East, consistent with APT34's established targeting pattern. The campaign spanned at least August 2017 through early 2018, with infrastructure active across that period. The use of victim-specific fingerprinting in the DGA (MAC address, whoami) indicates targeted deployments rather than broad opportunistic infection.

Booz Allen's report does not specify targeted sectors. The source focuses on the malware variants and infrastructure rather than victim profiling. APT34's broader targeting history includes government, financial, energy, and telecommunications organizations across the Middle East — consistent with Iranian state intelligence-gathering priorities.

A dropper executable is delivered to the target and run — in the ClearSky-linked cluster, delivery was via a malicious .chm (Compiled HTML Help) file. The dropper creates a PowerShell file (rUpdateChecker.ps1) in a staging directory named to look like a Java update folder, then deletes itself. That PowerShell script creates a VBScript and a Windows Scheduled Task that runs the script every minute. The VBScript deploys POWRUNER, which connects to the attacker's C2 server over TCP to receive commands and send back data. Most variants also include BONDUPDATER, which uses a domain generation algorithm to construct unique DNS subdomains for each C2 communication — making each request appear different and resisting static blocking.

Middle Eastern organizations represent high-value intelligence targets for Iranian state-linked actors. APT34 has consistently focused on government institutions, energy companies, and critical infrastructure across the Gulf region — sectors where persistent covert access provides strategic value for Iranian foreign policy and economic interests. The use of victim-specific identifiers embedded in BONDUPDATER's DGA suggests pre-operational reconnaissance to ensure each deployment is tailored to a specific target.