A Deep Dive into APT34's Leaked Tool: Analyzing the Jason Project

Jason is a graphical .NET tool designed to brute-force Microsoft Exchange accounts and harvest emails and credentials. It was leaked by Lab Dookhtegan on June 3, 2019, as part of a Telegram-based exposure of what were claimed to be APT34 tools. Marco Ramilli analyzed it independently and found weak code style similarities with other confirmed APT34 tools, though he notes these are insufficient for definitive attribution. The tool became especially significant when Yoroi and Telsy later assessed that APT34 likely used Jason to gain Exchange credentials before deploying the Karkoff and MailDropper implants against Lebanon's government in 2020.

Jason was leaked as part of the Lab Dookhtegan APT34 tool dump on Telegram. Ramilli identifies weak code style similarities with confirmed APT34 tools — similar exception-handling patterns and file logging conventions seen in Glimpse and WebMask — but explicitly states he cannot personally attribute Jason to APT34 based on code analysis alone. Attribution to APT34 rests primarily on the trusted source of the leak (Lab Dookhtegan) rather than technical evidence. Later use of Jason in the 2020 Lebanon Karkoff/MailDropper campaign provides stronger circumstantial evidence of APT34 ownership.

Jason is designed for credential theft and email collection. It brute-forces Exchange account credentials, then uses valid credentials to harvest emails and account information from targeted mailboxes. The downstream purpose — as seen in the 2020 Lebanon campaign — is to obtain Exchange credentials that can then be hardcoded into implants like MailDropper, enabling them to use compromised government Exchange servers as covert C2 infrastructure.

Jason v7.0 supports three attack modes: EWS (Exchange Web Services), OAB (Offline Address Book), or both simultaneously. It also includes a DNS domain discovery function that can auto-detect the Exchange server from a domain name. The attack is configured through a GUI — the operator provides the Exchange address, selects the attack method, and provides username and password lists or patterns. Thread count is configurable to balance attack speed and noise. The bundled password library includes year-based patterns, numeric sequences, special character patterns, and username-derived templates.

Based on the binary compilation date (January 2019) and the version string "Jason - Exchange Mail BF - v 7.0," the tool was compiled shortly before the leak. However, the use of a Microsoft.Exchange.WebService.dll version from 2012 (v15.0.0.0, with the last available version dating to 2015) suggests the project may have been initially developed years earlier and maintained over time. The high version number (v7.0) is consistent with long-term iterative development.

The Lab Dookhtegan leaks in 2019 exposed a range of tools attributed to APT34, including Jason, Glimpse, WebMask, and others. The leaks included tool source code, operator names, victim lists, and internal project files, causing significant disruption to APT34 operations. Jason's public exposure meant defenders could now develop signatures and protections for the tool — contributing to the YARA rule published by Ramilli. The leak also gave subsequent researchers like Yoroi and Telsy the context to link Jason to the 2020 Lebanon Exchange credential brute-force operations.

Jason's importance is as a precursor tool — a credential acquisition step that enables more destructive follow-on operations. Once Jason obtains valid Exchange credentials, those credentials can be hardcoded into implants like MailDropper or Karkoff, enabling attackers to use a victim's own government Exchange server as a covert C2. This creates a particularly difficult detection problem: the C2 traffic is encrypted Exchange email that originates from a legitimate institutional server, blending completely with normal organizational communications.