The Base64 Disguise: How GreenBug's Trojan ISMAgent Evades Detection

ClearSky discovered new samples of ISMAgent — Greenbug's custom espionage trojan — being delivered through a deceptive multi-stage chain. The attack started with a malicious Word document that exploited a known Microsoft Office vulnerability (CVE-2017-0199) to silently download and run a hidden PowerShell command, which then fetched what appeared to be a digital certificate file. That file was actually the ISMAgent malware encoded in base64, decoded on the victim's machine using a built-in Windows tool called certutil.exe. The decoded malware then ran silently under a filename designed to look like a legitimate Windows system process.

The campaign is attributed to Greenbug, an Iranian-linked cyberespionage group. ClearSky's analysis also identified that several infrastructure indicators from this campaign overlap with OilRig — another Iranian-linked threat group — suggesting possible shared infrastructure or coordinated operations between the two groups. Both are assessed to be aligned with Iranian state interests and have historically targeted organizations across the Middle East.

The goal was espionage. ISMAgent is a remote access trojan that gives attackers persistent, covert access to compromised systems — allowing them to collect credentials, capture system information, exfiltrate files, and maintain long-term footholds in targeted networks. This campaign represents Greenbug's continued effort to gain access to Middle Eastern technology organizations, consistent with prior campaigns linked to Iranian intelligence-gathering objectives.

ClearSky's report focuses on the technical delivery chain and new infrastructure samples rather than victim breadth. The targeting is assessed as Middle East-focused based on the group's known operational history and corroborating Palo Alto Networks reporting. The campaign activity window identified by ClearSky spans mid to late August 2017, with the infrastructure and samples likely used in targeted spearphishing operations against specific organizations rather than broad opportunistic attacks.

Based on Greenbug's known targeting pattern and concurrent Palo Alto Networks reporting, the campaign focused on technology organizations in the Middle East. ClearSky's report does not name specific victim organizations. The IT sector targeting is consistent with Greenbug's established interest in organizations that hold sensitive network access credentials or serve as entry points into broader enterprise infrastructure.

The attack used a malicious Word template (.dot file) that exploited CVE-2017-0199 when opened. This triggered a silent HTTP request to fetch a remote file from msoffice-cdn[.]com. That file executed a PowerShell command hidden from the user's view, which downloaded what appeared to be a text file from an anonymous file hosting service. The file was actually ISMAgent encoded in base64. A built-in Windows command-line tool (certutil.exe) was then used to decode it into an executable, which was saved with a name resembling a legitimate Windows process (srvConhost.exe) and run automatically. From that point, ISMAgent connected to attacker-controlled C2 servers over HTTP.

Middle Eastern technology organizations are attractive to Iranian-linked actors for several reasons: they often hold network credentials and access that can be leveraged to reach higher-value targets, they process sensitive data relevant to regional business and government operations, and compromising IT infrastructure can enable persistence across multiple downstream organizations. Greenbug's known connection to the Shamoon credential-theft-to-destruction pipeline makes IT sector access particularly valuable as a stepping stone to more damaging follow-on operations.