#apt34

[pavel-nosok]

Threat Actors Using New Malware Toolkit That Involves IIS Backdoor, DNS Tunneling

The Iranian threat actor APT34, also known as GreenBug, has recently launched a new campaign targeting Iraqi government entities by employing a custom toolset, including a novel IIS backdoor and DNS tunneling protocol.  The malware used in this campaign shares similarities with previously reported APT34 malware families, such as Karkoff, Saitama, and IIS Group 2.  […] The post Threat Actors Using…

[digitalcreationsllc]

Crambus: New Campaign Targets Middle Eastern Government

The Iranian Crambus espionage group (aka OilRig, MuddyWater, APT34) staged an eight-month-long intrusion against a government in the Middle East between February and September 2023. During the compromise, the attackers stole files and passwords and, in one case, installed a PowerShell backdoor (dubbed PowerExchange) that was used to monitor incoming mails sent from an Exchange Server in order to…

View On WordPress

[pavel-nosok]

APT34 Employs Weaponized Word Documents to Deploy New Malware Strain

APT34 is a secretive cyberespionage group specializing in Middle East targets, known for gathering sensitive intelligence via spear phishing and advanced infiltration methods. The sophistication and comprehensive resources of the APT34 group pose a major regional and global cybersecurity threat.  They have conducted high-profile cyberattacks in the Middle East against diverse targets:-…

View On WordPress

[pavel-nosok]

Hacker Group Disguised as Marketing Company to Attack Enterprise Targets

In a recent development, NSFOCUS Security Labs has detected a fresh APT34 phishing attack.  During this operation, APT34, believed to originate from Iran and also known as OilRig or Helix Kitten, assumed the identity of a marketing services company named Ganjavi Global Marketing Services (GGMS).  They meticulously targeted enterprises, employing a variant of the SideTwist […] The post Hacker…

View On WordPress

[trustednewssites]

Report: CIA Behind APT34, FSB Hacks, And Data Dumps

Report: CIA Behind APT34, FSB Hacks, And Data Dumps

Report: CIA Behind APT34, FSB Hacks, And Data Dumps

CIA headquarters in Langley, VA. (Image: file photo)

BRENDAN SMIALOWSKI/AFP/Getty Images Special feature

Cyberwar and the Future of Cybersecurity

View On WordPress

[monohedron]

[fatcashmoney]

Ajax Security Team, 3 Minute Profile

The Ajax group began in 2010 with website defacement attacks, but their activity escalated to cyber espionage by 2013. The group’s C&C infrastructure was set to Iran Standard Time and used the Persian language. The Ajax team consists of 5-10 members and it is unclear if the group is part of a larger movement such as the Iranian Cyber Army. The group may have been founded by members using the monikers “HUrr!c4nE!” and “Cair3x.” The Ajax group uses custom malware, but they do not leverage software exploits. The lack of exploits indicates that the group is more likely a patriotic hacktivist group than a state sponsored threat. Ajax group associated name are Ajax team or Ajax Security team, Operation Flying Kitten and Operation Saffron Rose. Ajax group may be part of Iranian Cyber Army, the group primarily targets United States defense contractors, firms that developed technologies that bypassed the Iranian censorship policies, and Iranian dissidents.

ajaxsecurity