APT34's Menorah Malware: A Look at the New Cyber Threat Targeting Saudi Arabia

In August 2023, Trend Micro's threat hunters identified a targeted spearphishing campaign by the Iranian state-linked group APT34 that deployed a new custom backdoor called Menorah. The malware was hidden inside a malicious Word document disguised as a government license registration form. Once a victim opened the document and enabled macros, Menorah was silently installed on their machine, giving the attackers persistent remote access to the system.

In August 2023, Trend Micro's threat hunters identified a targeted spearphishing campaign by the Iranian state-linked group APT34 that deployed a new custom backdoor called Menorah. The malware was hidden inside a malicious Word document disguised as a government license registration form. Once a victim opened the document and enabled macros, Menorah was silently installed on their machine, giving the attackers persistent remote access to the system.

The attack was carried out by APT34, also known as OilRig — an Iranian state-sponsored hacking group that has been active since at least 2014. APT34 is widely believed to operate in support of Iran's intelligence objectives and has a long track record of targeting governments, critical infrastructure, and private organizations across the Middle East and beyond. Trend Micro attributed this campaign to APT34 based on infrastructure overlap, code similarities to prior APT34 tools, and consistent attack patterns.

The campaign was a cyberespionage operation. The Menorah backdoor was designed to silently collect information from infected systems — including file listings, specific documents, system identity details, and shell command outputs — and send that data back to a remote server controlled by the attackers. The goal was covert, long-term access to the victim's network for intelligence collection rather than immediate disruption or financial theft.

Based on available evidence, this appears to have been a narrowly targeted campaign directed at a specific organization in Saudi Arabia. The lure document — a fake government license form from the Seychelles Licensing Authority — contained pricing in Saudi Riyal, which strongly suggests the intended victim was a Saudi-based entity. No broader list of victims was identified by researchers. APT34's broader pattern, however, shows consistent targeting of Middle Eastern governments, energy companies, and critical infrastructure across the region.

The attack appears to have targeted an organization within Saudi Arabia, likely in or connected to government-regulated sectors given the use of a government licensing document as the lure. APT34 typically focuses on government agencies, energy and critical infrastructure, telecommunications, and financial institutions across the Middle East. While this specific campaign targeted a single organization, the group's historical operations have impacted a broad range of sectors in the region.

The attack started with a spearphishing email carrying a malicious Word document ("MyCv.doc"). When the victim opened the document and enabled macros, hidden code silently dropped the Menorah malware onto the system in a folder mimicking a Microsoft Office directory. The malware then created a scheduled task with a legitimate-sounding name to run itself automatically. Once active, Menorah connected to the attackers' remote server every 32 seconds, sent a fingerprint of the victim's machine, and awaited instructions — including commands to list files, upload documents, run system commands, or download additional tools.

Saudi Arabia is a high-value target for APT34 due to its geopolitical significance, its role as a major energy producer, and its position in regional politics that puts it in direct tension with Iran's strategic interests. Organizations in Saudi Arabia — particularly those connected to government, energy, or regulated industries — hold sensitive information that would be valuable to Iranian intelligence services. APT34 has repeatedly focused on Saudi Arabian targets over many years, making the kingdom one of the group's primary areas of operation.