Iranian Cyber Group OilRig Targets Iraqi Authorities in Subtle Malware Assault
Iraqi authorities networks have emerged because the goal of an “elaborate” cyber assault marketing campaign orchestrated by an Iran state-sponsored menace actor referred to as OilRig.
The assaults singled out Iraqi organizations such because the Prime Minister’s Workplace and the Ministry of Overseas Affairs, cybersecurity firm Test Level mentioned in a brand new evaluation.
OilRig, additionally referred to as APT34, Crambus, Cobalt Gypsy, GreenBug, Hazel Sandstorm (previously EUROPIUM), and Helix Kitten, is an Iranian cyber group related to the Iranian Ministry of Intelligence and Safety (MOIS).
Lively since a minimum of 2014, the group has a observe report of conducting phishing assaults within the Center East to ship a wide range of custom backdoors equivalent to Karkoff, Shark, Marlin, Saitama, MrPerfectionManager, PowerExchange, Photo voltaic, Mango, and Menorah for data theft.
The most recent marketing campaign is not any exception in that it includes using a brand new set of malware households dubbed Veaty and Spearal, which include capabilities to execute PowerShell instructions and harvest information of curiosity.
“The toolset used on this focused marketing campaign employs distinctive command-and-control (C2) mechanisms, together with a customized DNS tunneling protocol, and a tailored electronic mail based mostly C2 channel,” Test Level said.
“The C2 channel makes use of compromised electronic mail accounts throughout the focused group, indicating that the menace actor efficiently infiltrated the sufferer’s networks.”
A number of the actions that the menace actor took in executing the assault, and following it, have been in line with ways, strategies, and procedures (TTPs) that OilRig has employed when finishing up related operations previously.
This consists of using email-based C2 channels, particularly leveraging beforehand compromised electronic mail mailboxes to problem instructions and exfiltrate information. This modus operandi has been widespread to a number of backdoors equivalent to Karkoff, MrPerfectionManager, and PowerExchange.
The assault chain is kicked off by way of misleading information masquerading as benign paperwork (“Avamer.pdf.exe” or “IraqiDoc.docx.rar”) that, when launched, pave the way in which for the deployment of Veaty and Spearal. The an infection pathway is probably going mentioned to have concerned a component of social engineering.
The information provoke the execution of intermediate PowerShell or Pyinstaller scripts that, in flip, drop the malware executables and their XML-based configuration information, which embrace details about the C2 server.
“The Spearal malware is a .NET backdoor that makes use of DNS tunneling for [C2] communication,” Test Level mentioned. “The info transferred between the malware and the C2 server is encoded within the subdomains of DNS queries utilizing a customized Base32 scheme.”
Spearal is designed to execute PowerShell instructions, learn file contents and ship it within the type of Base32-encoded information, and retrieve information from the C2 server and write it to a file on the system.
Additionally written .NET, Veaty leverages emails for C2 communications with the top objective of downloading information and executing instructions by way of particular mailboxes belonging to the gov-iq.web area. The instructions enable it to add/obtain information and run PowerShell scripts.
Test Level mentioned its evaluation of the menace actor infrastructure led to the invention of a unique XML configuration file that is seemingly related to a 3rd SSH tunneling backdoor.
It additional recognized an HTTP-based backdoor, CacheHttp.dll, that targets Microsoft’s Web Data Providers (IIS) servers and examines incoming net requests for “OnGlobalPreBeginRequest” occasions and executes instructions after they happen.
“The execution course of begins by checking if the Cookie header is current in incoming HTTP requests and reads till the; signal,” Test Level mentioned. “The principle parameter is F=0/1 which signifies whether or not the backdoor initializes its command configuration (F=1) or runs the instructions based mostly on this configuration (F=0).”
The malicious IIS module, which represents an evolution of a malware categorised as Group 2 by ESET in August 2021 and one other APT34 IIS backdoor codenamed RGDoor, helps command execution and file learn/write operations.
“This marketing campaign in opposition to Iraqi authorities infrastructure highlights the sustained and targeted efforts of Iranian menace actors working within the area,” the corporate mentioned.
“The deployment of a customized DNS tunneling protocol and an email-based C2 channel leveraging compromised accounts highlights the deliberate effort by Iranian actors to develop and preserve specialised command-and-control mechanisms.”