Webinar Reviews Iran’s Cyber Operations, Malware and Front Companies
Summary
A webinar transcript surveys Iran’s cyber program, including state-linked groups, malware, ransomware, front companies and cryptocurrency. The speaker discusses the difficulty of attributing operations specifically to the MOIS or IRGC.
Key points
- The speaker traces Iran’s cyber capabilities from earlier defacements and the Stuxnet response to espionage, ransomware and activity targeting industrial control systems.
- Iran’s civilian intelligence ministry, MOIS, and military IRGC are described as active cyber operators; the speaker cautions that attribution between them is difficult.
- The webinar discusses custom malware, including Shamoon, ZeroCleare, Oil Check and Oil Booster, and describes reported use of cloud services and email for command and control.
- The speaker says Iranian state-linked and criminal activity can overlap, including through credential theft, social engineering and ransomware.
- The transcript describes front companies as a means of supporting cyber operations, citing alleged links between Cloudzy and malicious actors; it also recounts claims about earlier operations targeting universities and dissidents.
- The speaker says Iranian actors and affiliated groups use messaging platforms and cryptocurrency for communication, fundraising and other activity, while noting challenges in verifying public claims.
Article Details
- Topic
- Iranian state-sponsored and cybercriminal cyber operations, capabilities, and threat ecosystem
People
Qassem SoleimaniThe article describes revenge for his death as a continuing Iranian messaging theme and notes that a claimed connection to the October 7, 2023 attack has been disputed.RouhaniThe article says that after Rouhani came to power in 2009, the MOIS began to be favored for operations and intelligence, including cyber activity.StephWebinar presenter who discusses Iranian cyber activity and identifies herself as an Iran-focused researcher and former military and Department of Defense professional.
Threat Actors
APT 33An Iranian APT described as using impersonation and social engineering to obtain information or conduct espionage.APT 34An Iranian APT described as technically sophisticated; the article associates it with the Oil Check and Oil Booster malware.APT 39An Iranian APT linked in the article to Rana, a campaign targeting Iranian dissidents, international journalists, and companies opposed to the Iranian government.MuddyWaterAn Iranian threat group described as extremely active in 2022.Rampant KittenAn Iranian threat group described as active and as having breached Keepass.
Malware
BitLockerAnd then BitLocker was 2020 to 2022. BitLocker is Decryptor Key has been released.DharmaDharma was another Iranian ransomware activated one.Oil BoosterThe 2024 update for malware, oil check and Oil Booster have evolved and are using cloud providers for their command and control their C2, as well as some email based C2 abilities.Oil CheckThe 2024 update for malware, oil check and Oil Booster have evolved and are using cloud providers for their command and control their C2, as well as some email based C2 abilities.SamsamSamsam was one of their biggest campaigns.ShamoonSo we go back to Shamoon. Shamoon was was very, very prevalent, especially after Stuxnet.ZerocleareAnd this was also true with Zerocleare. Iran uses countries like Saudi Arabia and Bahrain almost as a testing ground.
Vendors
CloudzyHalcyon broke the news that Cloudzy was masquerading as a as a network hosting company in New York, and in reality, it was headquartered in Tehran and run by 6 or 7 different Iranians who had created fake biographies, aMicrosoftAnd that’s using Microsoft, which I think is very important to highlight.
Products
KeePassIn addition to the apts of the 30 series, for instance Rampant Kitten, I would like to highlight that they actually breached Keepass, the password keeper a two years ago.LinkedInPosing as LinkedIn researchers, they’ve had several successful ransomware campaigns, espionage and IP theft is a very constant activity for Iran as well.TelegramAPT is absolutely on the dark web, absolutely using Telegram.WhatsAppIf you’re Russia, Iran or China and have plans, you don’t want those leaking out because somebody has an ego on telegram or somebody is using WhatsApp and sharing it, right.
Tools
Countries
BahrainSyria, or there’s a physical incident against a US base in Iraq or anywhere else in the region, right, Bahrain or anywhere else.BelarusThese are already witnessed in Ukraine, Belarus, Israel, Syria, Yemen, and other high-conflict areas.ChinaIran’s relationships with other adversaries like China and Russia will continue to strengthen its cyber capabilities, but also its general position in world conflict, including its efforts in hybrid warfare.IranIran continues to quickly gain sophistication in Cyber.RussiaIran’s relationships with other adversaries like China and Russia will continue to strengthen its cyber capabilities, but also its general position in world conflict, including its efforts in hybrid warfare.Saudi ArabiaThey will taunt Saudi Arabia, they will taunt companies and say, you know how we’ve infiltrated your systems.UkraineThese are already witnessed in Ukraine, Belarus, Israel, Syria, Yemen, and other high-conflict areas.United Statesfeel that teaming up with Russia and China will do that, because they fault the West, Europe and the United States for having isolated them since 1979 sanctions, keeping them out of important world meetings and world