Iranian hackers target researchers using new MediaPl malware

The latest news indicates that a group of Iranian-supported state hackers is targeting prominent employees of European and American research institutions and universities with spear-phishing attacks to push new backdoor malware.

These attackers, a subgroup of the notorious APT35 Iranian cyber espionage group (also known as Charming Kitten and Phosphorus) linked to the Islamic Revolutionary Guard Corps (IRGC), are sending customised and difficult-to-detect phishing emails through previously compromised accounts.

Since November 2023, a distinct threat group of Mint Sandstorm (PHOSPHORUS) has been observed targeting high-profile individuals working on Middle Eastern affairs at universities and research organisations in Belgium, France, Gaza, Israel, the United Kingdom, and the United States.

In this campaign, Mint Sandstorm used customised phishing lures in attempts to socially engineer targets into downloading malicious files. In a handful of cases, new post-compromise techniques were observed, including the use of a new custom backdoor called MediaPl.

The MediaPl malware uses encrypted communication channels to exchange information with its Command and Control (C&C) server and is designed to disguise itself as Windows Media Player to evade detection.

Communication between MediaPl and its C&C server uses AES CBC encryption and Base64 encoding. Variants found on infected devices have the ability to terminate automatically, pause temporarily, retry C&C communication, and execute C&C commands using the _popen function.

The second PowerShell-based backdoor malware, known as MischiefTut, helps delete other malicious tools and provides reconnaissance capabilities, allowing attackers to run commands on the hacked system and send the output to an attacker-controlled server.

The attack chain behind the ongoing APT35 campaign (Microsoft)

This APT35-affiliated group focuses on attacking and stealing sensitive data from compromised systems of high-value targets. The threat group was previously known for targeting researchers, professors, journalists, and other individuals with insights into security and policy issues of interest to Iran.

Those who work with or have the potential to influence the intelligence and policy communities are attractive targets for adversaries seeking to gather intelligence for countries like Iran that sponsor their activities.

Based on the identities of the targets observed in this campaign and the use of lures related to the Israel-Hamas war, this campaign may be an attempt to gather perspectives on war-related events from individuals of different ideologies.

Between March 2021 and June 2022, APT35 installed the previously unknown Sponsor malware on at least 34 companies in a campaign targeting government and healthcare organisations, as well as companies in financial services, engineering, manufacturing, technology, legal, telecommunications, and other industries.

The Iranian hacker group also used the never-before-seen NokNok malware when attacking macOS systems, another backdoor designed to collect, encrypt, and exfiltrate data from infected Macs.

Another Iranian threat group tracked as APT33 (aka Refined Kitten or Holmium) has conducted extensive password spray attacks against thousands of organisations worldwide since February 2023, compromising defense product and service providers, and was recently found attempting to compromise defense contractors using the new FalseFont malware.

Securitycompass Labs continuously tracks various APT groups, collecting and reconstructing their attack methods to help enterprises validate the effectiveness of their own defense systems.

You can search for the keywords "APT35" and "APT33" in the Securitycompass Security Measurement and Validation Platform to obtain the relevant attack simulation validation actions mentioned above, thereby verifying whether your security defense system can effectively counter attacks from this group. The platform ensures your validation process is safe and harmless in an industry-unique manner.