TA453 Campaign Deploys Novel PowerShell Backdoor and Mac-Specific Malware
- Actor Motivations: Espionage,Exfiltration
- Attack Vectors: Backdoor,Dropper,Malicious Macro,Spear Phishing
- Attack Complexity: High
- Threat Risk: High Impact/High Probability
In mid-May 2023, threat actor TA453 targeted a US-based nuclear security expert affiliated with a foreign affairs think tank using deceptive emails. After initial contact, TA453 deployed a novel PowerShell backdoor, GorjolEcho, via cloud hosting providers. Upon realizing the target used a Mac, they sent another malicious email that delivered Mac-specific malware, NokNok. TA453 operates in support of Iran's Islamic Revolutionary Guard Corps (IRGC), specifically focusing on entities and individuals in the foreign affairs sector, particularly those dealing with Middle Eastern affairs and nuclear security.
|Case||Royal United Services Institute (RUSI)|
The Royal United Services Institute is a defence and security think tank headquartered in London, United Kingdom. It was founded in 1831 by the Duke of Wellington, Sir Arthur Wellesley. Royal United Services Institute (RUSI) has been targeted by TA453 with abusive purposes.
Tip: 11 related IOCs (1 IP, 3 domain, 0 URL, 0 email, 7 file hash) to this threat have been found.
Source: Volexity - June 2023
Detection (one case): fuschia-rhinestone.cleverapps[.]io
Hint: Overlaps are extracted automatically by examining the IOCs associated with all indexed threats and actors.