Iran’s APT42 launched more than 30 spy attacks against militants and dissidents
A state-sponsored Advanced Persistent Threat (APT) actor newly dubbed APT42 (formerly UNC788) has been attributed with more than 30 confirmed spy attacks against individuals and organizations of strategic interest to the Iranian government at least since 2015.
Cybersecurity firm Mandiant said the group functions as the intelligence-gathering arm of Iran’s Islamic Revolutionary Guard Corps (IRGC), not to mention sharing partial overlaps with another cluster called APT35, also known as by Charming Kitten, Cobalt Illusion, ITG18, Phosphorus, TA453. , and yellow Garuda.
APT42 has shown a propensity to hit various sectors such as non-profit organizations, education, government, healthcare, legal, manufacturing, media and pharmaceuticals in at least 14 countries, including in Australia, Europe, the Middle East and the United States.
Pharma-targeted intrusions are also distinctive in that they began at the onset of the COVID-19 pandemic in March 2020, indicating the threat actor’s ability to quickly modify its campaigns to meet its operational priorities. .
“APT42 uses highly targeted spear phishing and social engineering techniques designed to build trust and build relationships with their victims in order to gain access to their personal or corporate email accounts or install Android malware on their mobile devices,” Mandiant said in a report.
The goal is to exploit fraudulent trust relationships to steal credentials, allowing the threat actor to leverage access to compromise tracking corporate networks to collect sensitive data and use the hacked accounts to phish other victims.
The attack chains involve a mix of highly targeted spear-phishing messages aimed at individuals and organizations of strategic interest to Iran. They are also designed with the aim of building trust with former government officials, journalists, policy makers and the Iranian diaspora abroad in hopes of spreading malware.
In addition to using hacked email accounts associated with think tanks to target researchers and other academic organizations, APT42 is often known to impersonate journalists and other professionals to engage with victims for several days or even weeks before sending a malicious link.
In an attack observed in May 2017, the group targeted members of an Iranian opposition group operating from Europe and North America with emails containing links to rogue Google Books pages, that redirected victims to login pages designed to siphon credentials and two-factor authentication codes.
Surveillance operations involve the distribution of Android malware such as VINETHORN and PINEFLOWER via text messages capable of recording audio and phone calls, extracting multimedia content and text messages and tracking geolocations. A VINETHORN payload spotted between April and October 2021 impersonated a VPN app called SaferVPN.
“Using Android malware to target people of interest to the Iranian government provides APT42 with a productive method of obtaining sensitive information about targets, including movements, contacts, and personal information,” the researchers noted. .
The group is also said to use a series of lightweight Windows malware from time to time – a PowerShell backdoor named TAMECAT, a VBA-based macro dropper called TABBYCAT, and a reverse shell macro known as VBREVSHELL – to increase their credential harvesting and espionage. Activities.
The links from APT42 to APT35 come from links to an uncategorized threat cluster tracked as UNC2448, which Microsoft (DEV-0270) and Secureworks (Cobalt Mirage) disclosed as a Phosphorus subgroup carrying out ransomware attacks for purposes financial using BitLocker.
Mandiant’s analysis further lends credence to Microsoft’s findings that DEV-0270/UNC2448 is operated by a front company that uses two public aliases, namely Secnerd and Lifeweb, both connected to Najee Technology Hooshmand.
That said, it is suspected that the two antagonistic collectives, despite their affiliation with the IRGC, come from disparate missions based on differences in targeting patterns and tactics employed.
A key point of distinction is that while APT35 is geared towards long-term, resource-intensive operations targeting different industry verticals in the United States and the Middle East, APT42’s activities focus on individuals and entities for “domestic policy, foreign policy and regime stability”. purposes.”
“The group has shown the ability to quickly shift its operational focus as Iran’s priorities change over time with changing national and geopolitical conditions,” the researchers said.