Chafer and Cadelle: Unveiling Iran's Persistent Cyber Surveillance on Middle Eastern Targets

Two Iran-based cyber espionage groups, Cadelle and Chafer, were found running long-term surveillance operations against individuals and organizations in Iran and across the Middle East. They used custom-built backdoor malware — Backdoor.Cadelspy and Backdoor.Remexi — to silently spy on victims, steal data, and maintain persistent access to compromised systems for up to a year. Symantec published its findings in December 2015, confirming both groups were still active at that time.

Two distinct groups were responsible: Cadelle, which deployed Backdoor.Cadelspy, and Chafer, which operated Backdoor.Remexi and Backdoor.Remexi.B. Both are assessed to be Iran-based, based on their working hours matching Iran's business week and time zone, the use of the Solar Hijri calendar in malware file strings, and a victim profile that aligns with the intelligence interests of an Iranian state entity. Symantec noted the groups may be working for a single Iranian-aligned organization, though no shared infrastructure was confirmed.

The campaign was a targeted espionage and surveillance operation. The attackers' goal was to monitor the movements and communications of persons of interest — including dissidents, activists, researchers, and anonymous proxy users inside Iran — by compromising the services those individuals rely on, such as airlines and telecommunications providers. The malware was designed to silently collect sensitive data over extended periods rather than to cause visible disruption.

The campaign was broad in geographic reach but focused in targeting. More than a dozen organizations were compromised across the Middle East, with victims identified in Iran, Saudi Arabia, Afghanistan, and other countries in the region, as well as at least one organization in the United States. A combined total of 60 computers in a single organization were infected simultaneously for close to a year. The majority of individual victims were Iranian internet users, including those using anonymous proxy services.

The primary institutional targets were telecommunications companies and airlines in the Middle East. At the individual level, the groups focused on Iranian internet users — particularly dissidents, activists, researchers, and people using anonymous proxy services to bypass government censorship. Some compromised systems belonged to web developers and database administrators, suggesting the attackers also targeted technical staff who could provide deeper network access.

Chafer gained initial access by exploiting vulnerabilities in web servers, likely through SQL injection, to install Backdoor.Remexi. Once inside, the malware harvested credentials and enabled remote shell access, allowing the attackers to move across the network. Cadelle's Backdoor.Cadelspy arrived as a dropper that installed a persistent payload, then silently collected keystrokes, screenshots, audio recordings, clipboard contents, and printer documents — compressing everything into archives and sending them to attacker-controlled servers over HTTP.

Telecommunications providers and airlines hold vast amounts of sensitive data about individuals — call records, travel itineraries, passenger manifests, and communication metadata. For a surveillance operation focused on tracking dissidents, activists, and persons of interest, these sectors offer a shortcut: instead of targeting each individual directly, the attackers could compromise one organization and gain access to data on thousands of people. This approach is harder to detect and yields far more intelligence at scale.