Iranian APT is targeting Middle Eastern Aerospace and Telecommunications companies
Iranian APT is targeting Middle Eastern Aerospace and Telecommunications companies
THREAT LEVEL: Amber.
For a detailed advisory, download the pdf file here.
ShellClient is a powerful new Remote Access Trojan (RAT) that was used in highly targeted attacks on a select few Aerospace and Telecommunications firms, primarily in the Middle East, with other victims in the United States, Russia, and Europe. The attacks were carried out by a newly uncovered Iranian activity group known as MalKamak, which has been active since at least 2018 but has remained unknown until now. ShellClient follows the trend of abusing cloud-based storage services, in this case the popular Dropbox service. The programmers of ShellClient decided to leave their old C2 domain and replace the malware’s C2 mechanism with a simpler C2 channel to exfiltrate stolen data and deliver commands to the malware.
The techniques used by ShellClient includes:
T1049 – System Network Connections Discovery
T1566 – Phishing
T1102 – Web Service
T1036 – Masquerading
T1003 – OS Credential Dumping
T1040 – Network Sniffing
T1543 – Create or Modify System Process
T1127 – Trusted Developer Utilities Proxy Execution
T1560 – Archive Collected Data
Actor Details
Indicators of Compromise (IoCs)
References
