Iranian OilRig Hackers Using New Backdoor to Exfiltrate Data from Govt. Organizations

The
Iranian
nation-state
hacking
group
known
as

OilRig
has
continued
to
target
government
organizations
in
the
Middle
East
as
part
of
a
cyber
espionage
campaign
that
leverages
a
new
backdoor
to
exfiltrate
data.

“The
campaign
abuses
legitimate
but
compromised
email
accounts
to
send
stolen
data
to
external
mail
accounts
controlled
by
the
attackers,”
Trend
Micro
researchers
Mohamed
Fahmy,
Sherif
Magdy,
and
Mahmoud
Zohdy

said.

While
the
technique
in
itself
is
not
unheard
of,
the
development
marks
the
first
time
OilRig
has
adopted
it
in
its
playbook,
indicating
the
continued
evolution
of
its
methods
to
bypass
security
protections.

The
advanced
persistent
threat
(APT)
group,
also
referred
to
as
APT34,
Cobalt
Gypsy,
Europium,
and
Helix
Kitten,
has
been

documented
for
its
targeted
phishing
attacks
in
the
Middle
East
since
at
least
2014.

Linked
to
Iran’s
Ministry
of
Intelligence
and
Security
(MOIS),
the
group
is
known
to
use
a
diverse
toolset
in
its
operations,
with
recent
attacks
in
2021
and
2022
employing
backdoors
such
as

Karkoff,

Shark,
Marlin,
and

Saitama
for
information
theft.

The
starting
point
of
the
latest
activity
is
a
.NET-based
dropper
that’s
tasked
with
delivering
four
different
files,
including
the
main
implant
(“DevicesSrv.exe”)
responsible
for
exfiltrating
specific
files
of
interest.

Also
put
to
use
in
the
second
stage
is
a
dynamic-link
library
(DLL)
file
that’s
capable
of
harvesting
credentials
from
domain
users
and
local
accounts.

The
most
notable
aspect
of
the
.NET
backdoor
is
its
exfiltration
routine,
which
involves
using
the
stolen
credentials
to
send
electronic
missives
to
actor-controlled
email
Gmail
and
Proton
Mail
addresses.

“The
threat
actors
relay
these
emails
via
government
Exchange
Servers
using
vaild
accounts
with
stolen
passwords,”
the
researchers
said.

The
campaign’s
connections
to
APT34
stems
from
similarities
in
between
the
first-stage
dropper
and
Saitama,
the
victimology
patterns,
and
the
use
of
internet-facing
exchange
servers
as
a
communication
method,
as
observed
in
the
case
of

Karkoff.

If
anything,
the
growing
number
of
malicious
tools
associated
with
OilRig
indicates
the
threat
actor’s
“flexibility”
to
come
up
with
new
malware
based
on
the
targeted
environments
and
the
privileges
possessed
at
a
given
stage
of
the
attack.

“Despite
the
routine’s
simplicity,
the
novelty
of
the
second
and
last
stages
also
indicate
that
this
entire
routine
can
just
be
a
small
part
of
a
bigger
campaign
targeting
governments,”
the
researchers
said.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts