Analysis of the Iranian cyber attack landscape

Table of Contents

1. Most recent Iranian cyber attack news and attack campaigns

2. Iranian cyber attack history and strategy

3. Iranian cyber attack campaign updates by APT group

Iran often adopts an asymmetric warfare strategy to accomplish its political and military goals, and its development of cyberwarfare capabilities adds to this asymmetric toolkit, allowing the country a low-cost means to conduct espionage and attack stronger adversaries. A risk-averse actor, Iran generally seeks to avoid direct military confrontation against conventionally superior foes. This makes the cyber realm an optimal choice for attack as it provides a means for Iran to exploit enemy vulnerabilities at a low intensity while also minimizing the risk of escalation or retaliation. Over the last decade, Iran has waged a number of disruptive and destructive cyber campaigns against government entities and companies alike, becoming infamous for its deployment of wiper malware as well as its retaliatory attack strategy. The threat of Iranian cyber operations continues to rise as challenges in relation to the renewal of the 2015 Iranian Nuclear Deal persist and regional tensions, specifically between Israel and Iran, escalate. As Iran increases collaboration with Russia and China in matters of policy, security, and trade, it is likely there will be cooperation in matters of offensive and defensive cyber operations, placing the U.S. in a precarious position as a main adversary of all three countries. This article provides an overview of the Iranian cyber threat landscape, including the history of Iranian cyber strategy, the most recent news regarding its attack campaigns, and descriptions of major Iranian cyber threat groups.

Most recent Iranian cyber attack news and attack campaigns

OilRig ‘Out to Sea’ Campaign

TLDR: OilRig is leveraging a new backdoor dubbed Marlin as part of a long-running espionage campaign that started in April 2018. Victims of the campaign, which researchers named ‘Out to Sea’ [PDF], include diplomatic organizations, technology companies, and medical organizations in Israel, Tunisia, and the UAE.

More information: Over the course of three and a half years, OilRig has used various backdoors, starting with DanBot, as well as using the Shark backdoor in April 2021 before transitioning to the Milan backdoor and the new backdoor Marlin in August 2021. Marlin is a notable split from OilRig’s typical TTPs. Danbot, Shark, and Milan use both DNS and  HTTP/S for C2 communications, while Marlin uses the OneDrive API for C2 communications. Post-intrusion activities include lateral movement, as well as data collection and exfiltration via browser-data theft and a keylogger. OilRig uses two initial access vectors: spearphishing and through ITbrain, which is a remote administration software, used in conjunction with the remote access tool TeamViewer.  

Iran MosesStaff APT

TLDR: Cybereason recently released a report detailing the Iranian threat actor Moses Staff, which was first spotted in October 2021. Moses Staff leverages both espionage tactics and ransomware to advance Iran’s geopolitical goals, but instead of using ransomware for financial gain, Moses Staff encrypts files for two purposes: inflicting damages by disrupting critical business operations and covering the attacker’s tracks. 

More information: Cybereason detailed a new RAT dubbed StrifeWater, which is assessed to be used specifically in the initial stage of compromised and is later replaced with other executables. StrifeWater is used to create a foothold in victim and environments, and it has various functions, including executing system commands, screen capturing, establishing persistence, listing system files, and downloading updates and additional modules. The RAT was likely not detected before as it has the ability to remove itself from the victim machine in time for the deployment of malware. Moses Staff is deemed to be a politically motivated group that consistently makes a conscious effort to evade detection until the last stage of attack where they deploy the ransomware to disrupt operations, obfuscate espionage activity, and inflict damage to systems.

Iran hackers targeting VMware

TLDR: SentinelOne has recently released a report on an Iranian-aligned threat actor targeting VMware Horizon Log4j vulnerabilities to deploy ransomware. Dubbing the threat actor  ‘TunnelVision,’ whose TTPs overlap with those of Charming Kitten and Phosphorus, the researchers observed that the group is characterized by the wide exploitation of one-day vulnerabilities in specific regions. 

More information: TunnelVision has been observed exploiting Fortinet FortiOS (CVE-2018-13379), Microsoft Exchange (ProxyShell) and the recent Log4Shell vulnerabilities. When exploiting these flaws, the threat actor almost always deploys a tunneling tool, the most common of which are Fast Reverse Proxy Client (FRPC) and Plink. TunnelVison has been exploiting the Log4j vulnerability in VMware Horizon to run PowerShell commands, and the group’s activities have been linked to the deployment of ransomware.

MuddyWater abuses Slack API to steal airline data 

MuddyWater was discovered to be deploying a new backdoor called ‘Aclip’ that abuses the Slack API for covert C2 communications. 

The Aclip backdoor uses the Slack API to send system data, files, and screenshots to the C2 while receiving PowerShell commands at the same time. Researchers first spotted the activity in March 2021, but the MuddyWater campaign began in October 2019 targeting an Asian airline to steal flight reservation and continued to 2021.  

MuddyWater targeting telecoms in Middle East and Asia

Symantec has identified MuddyWater as responsible for a new cyberespionage campaign targeting telecommunication and IT service providers in Asia and the Middle East for over six months. 

Leveraging legitimate tools, publicly available malware, and living-off-the-land tactics, MuddyWater focused on targeting Exchange Servers as part of a larger effort to deploy web shells and establish a backdoor within target networks. Once they successfully breached a network, MuddyWater attempted to steal credentials and move laterally. In some cases, the threat actors may have been using compromised organizations to gain access to other victims in supply-chain-type attacks. 

Geopolitical

• The eighth round of talks in Vienna to discuss the JCPOA commences. Iranian officials state the delegations agreed that “good progress” was made during the seventh round that ended 10 days earlier, and there is now a “suitable framework” to take the talks forward.

• The IRGC fires 16 surface-to-surface ballistic missiles at the close of five days of military drills that generals said were a warning to Israel.

Siamese Kitten

Iranian APT group Siamesekitten [PDF] was identified as responsible for a supply chain attack campaign that targeted IT and communication companies in Israel. Siamesekitten has been active since 2018 and has in the past targeted oil, gas, and telecom companies. Researchers have linked the group with low confidence to APT33 and APT34. The attacks occurred in two waves in May and July 2021 and involved impersonating IT companies and their HR personnel to lure IT experts, compromise their computers, and gain access to the company’s clients. The purpose of these attacks and their focus on IT and communication companies is believed to be to facilitate supply chain attacks on their clients. The group's main goal is to conduct espionage and utilize the infected network to gain access to their clients’ networks. As with other groups, it is possible that espionage and intelligence gathering are the first steps toward deploying ransomware or wiper malware.

Tortoiseshell Facebook Attack Campaign

On July 15th, Facebook revealed it tracked and partially disrupted a long-running Iranian attack campaign that used accounts to pose as recruiters and draw in US targets before sending them malware-infected files or tricking them into entering sensitive credentials to phishing sites. Facebook stated that the attackers also pretended to work in hospitality, medicine, journalism, NGOs, or airlines, sometimes conversing with their targets for months with profiles across various social media platforms. Unlike a number of past cases of Iranian state-sponsored social media phishing that have focused on Iran's neighbors, this latest campaign appears to have largely targeted Americans and (to a lesser extent) British and European victims. Facebook stated it has removed "fewer than 200" fake profiles from its platforms as a result of the investigation, as well as notified roughly the same number of users that they had been targeted. 

The hackers behind the campaign have been identified as Tortoiseshell, which is believed to work on behalf of the Iranian government. The group, which has some loose ties and similarities to other Iranian APTs like APT34 and Charming Kitten, first came to light in 2019. At that time, Symantec observed the attackers breaching Saudi Arabian IT providers in an apparent supply chain attack designed to infect the customers with malware known as Syskit. Facebook has spotted that same malware being used in this most recent campaign, but this operation has a far broader set of infection techniques and targets outside of the Middle East. The social media platform says it tied the group's malware samples to a specific Iranian-based IT contractor called Mahak Rayan Afraz, which has previously provided malware to the IRGC, indicating a link between the Tortoiseshell group and the Iranian government.

Charming Kitten Impersonation Campaign

Charming Kitten members, claiming to be a "senior teaching and research fellow" at SOAS university in London sent targeted emails to a select number of victims from fewer than 10 organizations in the US and UK, inviting them to an online conference called “The US Security Challenges in the Middle East.” The email would start a conversation between the attackers and victims (sometimes being quite lengthy to establish trust), which would include the attackers encouraging the victim to open a “registration link” hosted by a real website that had already been compromised by the attackers. This then offered a means to log on using email providers, which could then capture the passwords and user names. 

Stealing such credentials is not new, but the use of a real website marked a change as it was highly unusual and more sophisticated for this group. The fact the attackers were attempting to connect in real-time with victims over phones and video conferences for conversations rather than just engaging over email is also unusual, suggesting confidence in the attackers’ skills in English and in impersonation (although it is not clear if any conversations ended up taking place). The operation targeted individuals from three groups: Senior think-tank personnel researching the Middle East, journalists focused on the region, and academics, including senior professors. It is thought they were likely targeted because they might have information on foreign policy of countries towards Iran, negotiations over Iran's nuclear program, or information about Iranian dissidents.

State-sponsored APT Agrius

In late May, SentinelLabs observed a new Iranian state-sponsored APT, which they dubbed Agrius, as conducting an extensive espionage/destruction campaign against Israeli targets since 2020. Initially engaged in espionage activity, Agrius deployed a set of destructive wiper attacks against Israeli targets, masquerading the activity as ransomware attacks. Masquerading the attacks as ransomware provides the threat actors with plausible deniability, which allows the nation-state to send a message without taking direct blame.

Agrius exploits publicly facing VPN services (primarily ProtonVPN) for initial access, deploying web shells to tunnel RDP traffic as well as leveraging compromised accounts and using a variety of publicly available tools for lateral movement and credential harvesting. On hosts of interest, Agrius deploys its own custom malware - a .NET backdoor called 'IPsec Helper,' which registers itself as a service to establish persistence. The APT has also deployed two different wipers:  novel wiper malware 'Apostle' and DEADWOOD (aka Detbosit), which has been used in previous Iranian wiper attacks against Middle Eastern targets.

OilRig’s new SideTwist backdoor variant

In April 2021, a new campaign by OilRig was discovered by researchers at Checkpoint in which the group employed a new backdoor variant — dubbed SideTwist — against what appears to be a Lebanese target. Using the same initial intrusion vector as several of its previous campaigns, OilRig delivers its malware through a job opportunity document containing malicious macros with DNS (Domain Name System) tunneling that executes the payload and establishes persistence. The second stage payload, SideTwist, has not been seen before in OilRig operations, though its functionality, which includes download, upload, and shell command execution, is similar to other backdoors the group has employed in past campaigns (e.g. DNSpionage and TONEDEAF).

Infy’s Lightning & Thunder active again

In early 2020, new versions of Foudre — a malware associated with the APT (Advanced Persistent Threat) Infy (discussed in detail below) — emerged with new and improved elements from previous versions. This newest edition of the malware includes novel documents containing macros that extract the embedded package once opened and execute it once the document closes (instead of having the victim click on a video link as before). The malware also contains a new component called Tonnerre (French for “thunder”) — a second-stage payload used for persistence, surveillance, and data exfiltration. Once the malware is dropped and executed through the lure documents, the Foudre backdoor connects to the HTTP command-and-control (C2) server and downloads a self-extracting archive with full-featured Tonnerre malware. Using dual C2 communication, Tonnerre uses HTTP to communicate with the first server for commands and updates and FTP to communicate with the second server to which the stolen data is exfiltrated. Camouflaging itself as legitimate software, the executable is exceptionally large at 56MB — an unusual size for malware samples that may allow it to avoid detection as vendors typically avoid large file sizes. This campaign also strays from Infy’s usual target group of Iranian individuals and entities, with victims of Foudre located in Sweden, the Netherlands, the U.S., along with others across Europe, Iraq, and India.

Now, there are some key differences to note in the newest versions of Foudre:

• DGA Formula: The algorithm for generating domains has been updated and includes the TLDs (top-level domains) of .space, .net, .dynu.net, and .top to evade detection of security vendors using the previously published DGA (domain generation algorithm)
• C2 RSA Verification: The malware verifies that the server is authentic by downloading a signature file that is signed by the server and ensuring that it is the right one to make the operation more resilient to take-downs
• The Foudre string no longer present: The window used for keylogging was originally named “Foudre” (giving the malware its name), but has now been renamed to “form1” to help the malware evade signature-based detection

Charming Kitten’s ‘BadBlood’ campaign

Cybersecurity researchers recently uncovered a phishing campaign, dubbed BadBlood, aimed at 25 senior professionals specializing in genetic, neurology, and oncology research in the U.S. and Israel. The campaign was carried out in late 2020, but it was detected, analyzed, and published in late March 2021. It is attributed to Iranian state-sponsored APT Charming Kitten, whose other recent attacks include targeting world leaders attending the Munich Security Conference and the T20 Summit in Saudi Arabia in an effort to steal their email credentials, targeting Israeli scholars and U.S. government employees in another credential-stealing effort last July, and also attacking the re-election effort of former President Donald Trump.

Of note:

• The bottom line is that BadBlood is not one of its kind; however, for Charming Kitten, it implies a shift in target and collection priorities as they usually target dissidents, academics, diplomats, and journalists in order to further Iranian IRGC interests.
• The motives have not yet been definitively determined, but are guessed to be the result of a one-off attempt to gather intelligence that potentially can be used in further phishing campaigns. Additional investigation will reveal more about the goals of Charming Kitten regarding the medical sector.

MuddyWater’s ‘Earth Vetala’ campaign

In early March 2021, Trend Micro detected activity targeting numerous organizations in the Middle East and neighboring regions in a campaign dubbed Earth Vetala. The cyber espionage campaign has been attributed to Iranian APT MuddyWater (aka Static Kitten) and is reported to be actively ongoing, targeting government agencies, as well as entities in the sectors of tourism and academia, within countries including the UAE, Saudi Arabia, and Israel. The attackers behind Earth Vetala use features of remote access software to steal sensitive information or download malware for additional cyber operations, leveraging spearphishing emails and lure documents containing embedded links to a legitimate file-sharing service (Onehub) to distribute archives containing the ScreenConnect remote administrator tool and RemoteUtilities software.

Once accessing a victim, the attackers would determine if the user account was an administrator or normal user and then download post-exploitation tools, including utilities to dump passwords, reverse-tunneling tools, and custom backdoors. They would then initiate communication with additional C2 infrastructure to execute obfuscated PowerShell scripts. As MuddyWater is assessed to be primarily focused on cyber-espionage, it is very likely that data theft is the primary objective behind the Earth Vetala campaign.

Iranian cyber attack history

Since the Iranian revolution and the establishment of the current Islamic Republic in 1979, Iranian leadership has been in near-constant conflict with the West and several of its Middle Eastern neighbors. The United States’ previous alliance with the overthrown Pahlavi dynasty and the ensuing hostage crisis set the stage for the tensions that would follow between the two nations in the coming decades. The U.S. and its allies' efforts to contain, counter, and undermine the regime’s influence have taken a variety of forms, including diplomacy, legal action, and economic sanctions. Iran’s determination to establish itself as a nuclear power has also exacerbated the West’s growing concern over the rogue nation’s military ambitions, which strategically include Iranian cyber attacks.

Thus, the 2010 discovery of a sophisticated and largely unprecedented cyber-sabotage campaign targeting Iran’s nuclear facilities at Natanz would prove pivotal in the relationship between the U.S. and the Islamic Republic. While the U.S. government has never claimed responsibility for the Stuxnet virus that disabled hundreds of Iranian centrifuges, many have asserted that the operation was the work of U.S. and/or Israeli intelligence. This debate aside, Iranian officials wasted little time in publicly blaming the U.S. and Israel for the attacks. Following the Stuxnet attacks, Iran set itself on a course to aggressively develop its own cyberspace capabilities.

Additionally, on April 11th, 2021, it was reported that Iran’s Natanz nuclear facilities experienced a blackout after a large explosion destroyed the internal electric grid that supplies its underground uranium enrichment centrifuges. Though initial reports declared the attack as a cyber operation conducted by Israeli actors, evidence surfaced several days later indicating that the damage actually resulted from a physical attack conducted by a suspect that the Iranian state has identified as Reza Karimi. Nonetheless, Israel remains the prime suspect in the sabotage, and this incident has further inflamed tensions across the Middle East where the shadow war between Iran and Israel continues to escalate. Israel and Iran are well-known for their ongoing historical tensions and tit-for-tat attacks, and an amplification in tensions between the two countries has nearly always resulted in increased offensive cyber attacks. Given Iran’s history of using offensive cyber capabilities to respond to attacks or perceived threats to its national interests, there is a significant likelihood that Iran may choose the cyber realm as an attack vector to respond to this recent sabotage it attributes to Israel. The U.S. has been put in a difficult position because of this incident, as it is reluctant to publicly condemn its long-time ally but also does not want to distance itself from Iran as it seeks to revive the nuclear deal. It is possible that the U.S. may also become a target for Iran’s cyber retaliation, and if so, it is likely that Iran will target both government and private sector organizations in the U.S., specifically those in critical sectors like energy, financial services, healthcare, and shipping.

Iranian cyber attack strategy

Lacking the military and economic might of its Western rivals, Iranian leadership views the cyber realm as an asymmetric tool to do damage to their enemies and effectively gather intelligence on foreign governments, corporations, academic institutions, and NGOs — in addition to their own citizens. Once viewed as cyberspace “amateurs,” the Iranian intelligence apparatus has steadily and conspicuously grown its domestic cyber know-how. While Iranian cyber operators may not be viewed as “top tier” in terms of their technical sophistication, the regime’s willingness to conduct aggressive and destructive cyber operations dramatically increases the threat potential posed to those caught in the crosshairs. Highly disruptive operations, presumably carried out at the behest of the Ayatollah, have included drive-wiping attacks against Saudi oil companies and large-scale denial of service attacks against the U.S. financial sector. These actions have displayed open contempt for international norms and indicate the regime’s willingness to retaliate for a variety of perceived transgressions within the cyber domain.

As the last two years have given witness to dozens of malicious cyber campaigns attributed to numerous Iranian threat actors, it appears the regime’s plan has come full circle — cyber has become a full-fledged, core component of Iran’s strategy to harass, contest, and punish its adversaries across the Middle East and the globe.

Cooperative agreement with Russia and China

In January 2021, Iran signed a cooperation agreement on cybersecurity and information and communications technology (ICT) with Russia, establishing technology transfer, combined training, coordination in the UN and other multilateral forums, and cybersecurity cooperation between the two countries. The agreement presents itself as largely defense-oriented, driven by the two’s shared animosity toward the U.S., desire for greater internet censorship, and ambition to reduce dependence on Western technology. Due to mutual suspicion and conflicting goals, the cyber cooperation between Moscow and Tehran will likely be less focused on developing offensive capabilities and more focused on intelligence sharing and cyber defense improvement, which can have major implications for U.S. cyber initiatives [PDF] and security. With the United States being a key adversary of both countries, much of the cooperation and intelligence sharing will be focused on gathering insight on U.S. malware and TTPs (tactics, techniques, and procedures) in order to thwart future U.S. cyber operations. Russia could also help Iran to reverse-engineer the malware that has been deployed against it, and on an even more concerning note, it is possible that the technologies and TTPs that Tehran acquires from Moscow could be passed on to Iranian proxies across the Middle East, including Hezbollah and militia groups in Iraq and Yemen — some of which have already displayed sophisticated hacking capabilities.    

In March 2021, Iran and China signed a 25-year-long strategic cooperation agreement, establishing a long-term partnership focused on economic and defense collaboration. On the economic side, the deal includes Iran providing a discounted oil supply to China,  and in return, investing $400 billion in Iranian critical infrastructure — like railways, health care, IT, and telecommunications — over the next 25 years. On the security side, the deal seeks to increase military and defense cooperation between Tehran and Beijing, calling for joint training, exercises, research, weapon development, and intelligence sharing. Unlike the agreement between Russia and Iran mentioned above, there is not much mention of cyber cooperation in the China-Iran deal; the only mention of cyberspace is that China has offered to help Iran deploy greater internet censorship. However, given that there is going to be greater collaboration between the two in matters of security and defense, it can definitely be assumed that there will be cybersecurity cooperation and intelligence sharing on cyber threats between the two nations over the next several years. Considering the parameters of this long-term deal, past cooperation between the two nations, future trends of cyberwarfare, and the two’s shared political objectives and animus toward the U.S., I think it is likely that there will be joint cyber activity coming from Tehran and Beijing over the next 25 years — with the U.S. being the prime target.

Iranian cyber attack campaign updates by APT group

MuddyWater

Overview

MuddyWater is an Iran-linked threat group that has primarily targeted governmental entities, telecommunications companies, and IT firms located in the Middle East since at least 2017. From analysis of data and backdoor behaviors, it has been determined that MuddyWater’s motivations are likely information theft and espionage, with the group conducting numerous campaigns aimed at a variety of industries in different countries. The group has been tied to campaigns such as the 2021 Earth Vetala campaign targeting several countries in the Middle East; a hacking campaign publicly attributed to the group by Saudi Arabia in 2017; and campaigns targeting Central Asia in 2018 and Eastern Europe in 2019.

The group primarily relies on publicly available tools for lateral movement, credential theft, and exfiltration, achieving initial access via spearphishing emails with Word attachments containing macros to enable malicious payload delivery. MuddyWater has also continued to utilize and update a group of custom tools, many of which are scripts written in Python or PowerShell. 

Recent Activity

In early 2020, researchers identified a MuddyWater-linked campaign dubbed “Summer Mirage.” Based on the content and themes of the observed phishing emails and the attached malicious documents, the campaign may have targeted U.S. entities and the oil and gas sector. The malware used in this campaign also contained some new features, suggesting the group continues to update their preferred POWERSTATS PowerShell Trojan.

In October 2020, researchers at ClearSky identified a campaign targeting multiple Israeli organizations. The group attempted to install a malicious downloader known as PowGoop during this campaign. PowGoop was likely used during another recent intrusion into a Middle Eastern state-run organization in which an unidentified group of threat actors also deployed the Thanos ransomware. This activity suggests the presence of PowGoop may serve as a precursor to ransomware deployment. Separate reporting has also highlighted ongoing MuddyWater campaigns targeting Middle Eastern entities with potential links to the PowGoop malware.

Since MuddyWater has not historically been observed conducting ransomware attacks, researchers speculate that the actual goal of the operation may have been to serve as a de facto destructive attack, akin to the NotPetya attacks of 2017 and those carried out by other Iranian threat actors in the past. The use of ransomware could thus serve to hide the true motivations or culprits behind the attack.

Most recently, in March 2021, an actively ongoing cyberespionage campaign dubbed Earth Vetala was attributed to MuddyWater. Victims of the campaign include entities in the Middle Eastern countries of Israel, Saudi Arabia, the UAE, Bahrain, and Azerbaijan, primarily in the sectors of government, tourism, and academia. Earth Vetala uses phishing emails and lure documents to distribute legitimate remote administration tools, which the threat actors use to interact with the compromised host and download post-exploitation tools that include password-dumping utilities, reverse-tunneling tools, and custom backdoors.