Iranian Hackers Linked To Malware

For more than 5 years, Iran has maintained a reputation as one of the most aggressive nations in the global arena of state-sponsored hacking, stealing data from corporate and government networks around the world.

They have been bombarding US banks with cyberattacks, and most brazen of all, unleashing multiple waves of computer-crippling malware that hit tens of thousands of PCs across the Middle East.

But amidst that noisy mayhem, one Iranian group has managed to quietly penetrate a broad series of targets around the world, until now evading the public eye. And while that group seems to have stuck to traditional spying so far, it may also be laying the groundwork for the next round of destructive attacks.

Security firm FireEye has released new research into a group it calls Advanced Persistent Threat 33, attributing a prolific series of breaches of companies in the aerospace, defense, and petrochemical industries in countries as wide-ranging as Saudi Arabia, South Korea, and the US.

While FireEye has closely tracked APT33 since May of last year, the security firm believes the group has been active since at least 2013, with firm evidence that it works on behalf of Iran's government.

And though FireEye describes APT33's activities as largely focused on stealthy spying, they've also found links between it and a mysterious piece of data-destroying malware that security analysts have puzzled over since earlier this year.

"This could be an opportunity for us to recognise an actor while they’re still focused on classic espionage, before their mission becomes more aggressive," says John Hultquist, FireEye's director of intelligence analysis.

He compares APT33 to Sandworm, a hacking operation FireEye discovered in 2014 and tied to Russia, which began with spying intrusions against NATO and Ukrainian targets before escalating to data-wiping attacks in 2015 and finally two sabotage attacks against the Ukrainian power grid. "We've seen them deploy destructive tools they haven’t used. We're looking at a team whose mission could change to disruption and destruction overnight."

FireEye says it's encountered signs of APT33 in six of its own clients' networks, but suspects far broader intrusions. For now, it says the group's attacks have focused on Iran's regional interests. Even the targets in the US and Korea, for instance, have comprised companies with Middle East ties, though FireEye declines to name any specific targets.

"They’re hitting companies headquartered all over the world," Hultquist says. "But they’re being swept up into this activity because they do business in the Gulf."

Seeds of Destruction

Beyond run-of-the-mill economic espionage, FireEye has found infections of victim networks with a specific piece of dropper malware, a piece of software designed to deliver one or multiple other malware payloads, that the security firm calls DropShot.

That dropper had in some cases installed another malware weapon, which FireEye calls ShapeShift, designed to wipe target computers by overwriting every portion of a computer's hard drive with zeros.

While FireEye did not find that destructive malware in networks where it had identified APT33 hackers, it did find the same dropper used in APT33's intrusions to install a piece of backdoor software it called TurnedUp. It has also never seen the DropShot dropper used by another distinct hacker group, or distributed publicly.

The notion that Iranian hackers may be prepping another round of destructive attacks would hardly represent a break from form. In 2012, Iran-linked hackers calling themselves "Cutting Sword of Justice" used a piece of similar "wiper" malware known as Shamoon to overwrite the hard drives of 30,000 computers at Saudi oil behemoth Saudi Aramco with the image of a burning US flag.

The same year, a group calling itself the Izz ad-Din al-Qassam Cyber Fighters took credit for an unrelenting series of distributed denial of service attacks on US banking sites known as Operation Ababil, purportedly in revenge for the anti-Muslim YouTube video "the Innocence of Muslims".

Those attacks, too, were eventually pinned on Iran. And last year another round of Shamoon attacks ripped through the Middle East, destroying thousands more machines, this time overwriting the drives with the image of the body of a 3-year-old Syrian refugee who drowned in the Mediterranean.

Security firm Kaspersky first spotted ShapeShift in March of this year, calling it StoneDrill. Kaspersky noted that it resembles Shamoon, but with more techniques designed to evade security mechanisms, like the "sandbox" protections that limit a given application's access to the rest of a target computer.

Kaspersky wrote at the time that one of the two targets in which it found StoneDrill malware was European, whereas Shamoon's attacks had been confined to the Middle East. "Why is this worrying?" asked Kaspersky founder Eugene Kaspersky in a blog post about the discovery.

"Because this finding indicates that certain malicious actors armed with devastating cyber-tools are testing the water in regions in which previously actors of this type were rarely interested."

Critical infrastructure security firm Dragos has also tracked APT33, says the company's founder Robert M. Lee, and found that the group has focused the majority of its attention on the petrochemical industry. Dragos' findings back up FireEye's warning that the group seems to be sowing infections for destructive attacks.

"This is economic espionage with the added ability to be destructive, but we have no reason to think they’ve gone destructive yet," says Lee. He notes that despite the industrial focus of the hackers, they haven't tailored their malware to industrial control systems, only mainstream computer operating systems. "That didn't stop Iranian hackers from doing massive damage to Saudi Aramco."1

FireEye's evidence tying APT33 to Iran goes further than mere similarities between ShapeShift and Iran's earlier destructive malware, Shamoon. It also found plentiful traces of the Iranian national language Farsi in ShapeShift, as well as in the DropShot dropper used to install it.

Analysing the active hours of the hacker group, they found they were heavily concentrated during Tehran business hours, almost entirely ceasing during the Iranian weekend of Thursday and Friday.

The group's other hacking tools are ones commonly used by Iranian hackers, FireEye says. And one hacker whose pseudonym, "xman_1365_x", was included in the TurnedUp backdoor tool is linked to the Iranian Nasr Institute, a suspected Iranian government hacking organization.

APT33's attacks have in many cases begun with spearphishing emails that bait targets with job offers; FireEye describes the general polish and details of those messages down to the fine print of their "Equal Opportunity" statements.

But the company also notes that the group at one point accidentally fired off its emails without changing the default settings of its phishing software tool, complete with the subject line "your site hacked by me”, a rare one-off, sloppy mistake for a prolific state hacking group.

Ready to Blow

Even as Iran's hackers have caused mayhem for its neighbors, the country hasn't been tied to any high-profile hacker attacks against the US since 2012, perhaps in part due to the Obama administration's 2015 agreement with Tehran to end its nuclear development program.
 
But America's brief rapprochement with Iran may be closing again: President Trump recently spoke at the UN General Assembly, accusing Iran's government of pursuing "death and destruction," and calling the Obama deal with Tehran "an embarrassment."

Though APT33 seems focused for the moment on regional espionage, it's also carrying out "reconnaissance for attack," says FireEye's Hultquist. "With a sudden geopolitical shift, that behavior could change."

If it does, the group may already have its malware bombs planted around the world, ready to detonate.

Wired:

You Might Also Read: 

Iran Cyber Attacks on Saudi Arabia:

Iran’s Cyber Attacks Are Getting Much More  Sophisticated:

 

« China Wants To Use AI To Predict Civil Disorder
Facebook To Give Congress Thousands Of Election Ads Bought By Russians »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

International Association for Cryptologic Research (IACR)

International Association for Cryptologic Research (IACR)

(IACR is a non-profit scientific organization whose purpose is to further research in cryptology and related fields.

CFC Underwriting

CFC Underwriting

CFC is a specialist insurance provider and a pioneer in emerging risk, including cyber insurance.

Beachhead Solutions

Beachhead Solutions

Beachhead's SimplySecure is a configurable, web-based management tool allowing you to remotely secure vulnerable mobile devices in your organization.

CYBER 1

CYBER 1

CYBER 1 provides cyber security solutions to customers wanting to be resilient against new and existing threats.

Subex

Subex

Subex leverages its award-winning telecom analytics solutions in areas such as Revenue Assurance, Fraud Management, Asset Assurance and Partner Management, and IoT Security.

CyberProof

CyberProof

CyberProof aims to give clarity and confidence to businesses worldwide using a new risk-based approach to cyber security services.

Greensafe IT

Greensafe IT

Greensafe offer various onsite and offsite data erasure services, aimed at increasing data security whilst reducing any risk of data loss during transit.

Blockchain Research Institute (BRI)

Blockchain Research Institute (BRI)

Blockchain Research Institute (BRI) is an independent, global think-tank. We bring together the world’s top global researchers to undertake ground-breaking research on blockchain technology.

SightGain

SightGain

SightGain is the only integrated risk management solution focused on cybersecurity readiness using real-world attack simulations in your live environment.

Cyber Bytes Foundation

Cyber Bytes Foundation

Cyber Bytes Foundation exists to establish and sustain a unique Cyber Ecosystem to accelerate the development of a strong Cyber workforce and support community outreach programs.

Wazuh

Wazuh

Wazuh is a free, open source and enterprise-ready security monitoring solution for threat detection, integrity monitoring, incident response and compliance.

Aeries Technology

Aeries Technology

Aeries is a technology services organization offering capabilities in Technology Services, Digital Transformation, and Business Process Management.

Archer Technologies

Archer Technologies

Archer helps organizations manage risk in the digital era—uniting stakeholders, integrating technologies and transforming risk into reward.

Neya Systems

Neya Systems

Neya Systems, a leader in advanced off-road autonomy and high-level multi-robot mission planning, provides innovative solutions for uncrewed ground, aerial, and surface vehicles.

Dispel

Dispel

Dispel makes the fastest secure remote access for industrial networks. Built by operators for operators: a zero trust engine for your entire OT, IoT, and xIoT stack.

Velotix

Velotix

Velotix empowers organizations to maximize the value of their data while ensuring security and compliance in a rapidly evolving regulatory landscape.