In a recent development, NSFOCUS Security Labs has detected a fresh APT34 phishing attack. 

During this operation, APT34, believed to originate from Iran and also known as OilRig or Helix Kitten, assumed the identity of a marketing services company named Ganjavi Global Marketing Services (GGMS). 

They meticulously targeted enterprises, employing a variant of the SideTwist Trojan to gain sustained control over victim hosts.

A Glimpse into APT34

APT34, an Advanced Persistent Threat (APT) group active since 2014, specializes in cyber espionage and sabotage. 

Operating primarily in the Middle East, they target diverse sectors such as finance, government, energy, chemicals, and telecommunications. 

APT34 possesses advanced attack capabilities, tailoring intrusion methods for different targets and even demonstrating supply chain attack proficiency. 

Following the exposure of their primary attack tools in a 2019 leak, APT34 began developing new tools, including RDAT, SideTwist, and Saitama.

The Deceptive Bait

For this operation, APT34 utilized a decoy file titled “GGMS Overview.doc.” This document introduced a fictitious “Ganjavi Global Marketing Services” company, ostensibly providing global marketing services with a clear focus on enterprises.

Notably, two upload records in the United States suggest APT34’s intention to target U.S. businesses.

Attack Execution

The attack followed a known pattern, albeit with some variations. A malicious macrocode concealed within the decoy file orchestrated the deployment environment. 

This macrocode extracted the Trojan SystemFailureReporter.exe from the document in base64 format, placed it in the %LOCALAPPDATA%\SystemFailureReporter\ directory, and created an update.xml text file in the same directory, serving as the Trojan’s activation switch.

Subsequently, the malicious macro code established a scheduled task called “SystemFailureReporter,” summoning the Trojan every five minutes, ensuring its continuous operation. 

The Trojan, identified as a SideTwist variant, communicated via HTTP with a CnC server at 11.0.188.38:443.

Anatomy of the Trojan

This variant of the SideTwist Trojan, compiled using GCC, shares similarities with previous iterations but exhibits differences in the compilation. 

Its core functions involve communication with the CnC server, execution of commands, and file uploads. Upon execution, the Trojan checks for the presence of an “update.xml” file, employing anti-sandbox measures. 

It collects victim host information to generate a unique ID and initiates communication with the CnC server.

The CnC communication involves encrypted instructions, decoded using a multi-byte XOR key derived from the string “notmersenne.” These instructions dictate various actions, from running shell commands to downloading/uploading files.

Intriguingly, this APT34 campaign used the CnC IP address 11.0.188.38. Notably, port 443 did not respond, making it challenging to ascertain the nature of the CnC server.

Investigation revealed that this IP address belongs to the United States Department of Defense Network Information Center in Columbus, Ohio.

This choice of IP suggests that APT34 may have used this operation for testing, with the intention of activating a different, concealed CnC address in subsequent attacks.

APT34’s recent attack showcases its consistent methodology while introducing a GCC-based SideTwist Trojan variant and an enigmatic CnC IP address. This specificity implies a testing phase, safeguarding attack resources until the actual CnC address is enabled. 

This strategic approach underscores the adaptability and evasiveness of APT groups.

Keep informed about the latest Cyber Security News by following us on Google News, Linkedin, Twitter, and Facebook.