Iran-Linked Chafer Group Expands Toolset, Targets List

itman · Mar 1, 2018

New hack tools I never heard of before.

The Iran-based targeted attack group known as "Chafer" has been expanding its target list in the Middle East and beyond and adding new tools to its cyberweapon arsenal, Symantec warns.

Last year, the group engaged in a series of ambitious new attacks, hitting a major telecom companies in the Middle East and also attempting to attack a major international travel reservations firm. Active since at least July 2014 and already detailed a couple of years ago, Chafer is mainly focused on surveillance operations and the tracking of individuals.

Recently, Chafer employed seven new tools in addition to the malware already associated with the group. Most of these tools, Symantec points out, are freely available, off-the-shelf tools that have been put to a malicious use.

These include Remcom, an open-source alternative to PsExec; Non-sucking Service Manager (NSSM), an open-source alternative to the Windows Service Manager; a custom screenshot and clipboard capture tool; SMB hacking tools, including the EternalBlue exploit; GNU HTTPTunnel, an open-source tool to create a bidirectional HTTP tunnel on Linux computers; UltraVNC, an open-source remote administration tool for Windows; and NBTScan, a free tool for scanning IP networks for NetBIOS name information.
Click to expand...

https://www.securityweek.com/iran-linked-chafer-group-expands-toolset-targets-list

itman · Mar 1, 2018

Guess the "oldies but goodies" still work:

What is RemCom : RemCom is a small (10KB upx packed) remoteshell / telnet replacement that lets you execute processes on remote windows systems, copy files on remote systems, process there output and stream it back. It allows execution of remote shell commands directly with full interactive console without having to install any client software. On local machines it is also able to impersonate so can be used as a silent replacement for Runas command.

Platform and Language : RemCom is written in C++ and works on NT 4.0, Win2K, Windows XP and Server 2003 including x64 versions of Windows.
Click to expand...

https://github.com/kavika13/RemCom

guest · Mar 4, 2019

New Python-based payload MechaFlounder used by Chafer
March 4, 2019
https://unit42.paloaltonetworks.com/new-python-based-payload-mechaflounder-used-by-chafer/

This new secondary payload is Python-based and compiled into executable form using the PyInstaller utility. This is the first instance where Unit 42 has identified a Python-based payload used by these operators.

The lsass.exe file downloaded from this domain is a previously unreported python-based payload that we are currently tracking as MechaFlounder. We believe Chafer uses MechaFlounder as a secondary payload that the group downloads from a first-stage payload to carry out its post-exploitation activities on the compromised host.
And one more thing…
If you think you’ve seen the “&m=d” parameter before, you’d be correct. The “&m=d” parameter seen in the initial download URL of the MechaFlounder payload appears in many URLs related to both Chafer and OilRig threat groups.

The overlap in Oilrig’s Clayside VBScript and Chafer’s AutoIT payloads does not come as a complete surprise. Oilrig and Chafer have for quite some time appeared very similar operationally and potentially having access to the same code or resources for payload development makes sense.
Click to expand...

guest · May 21, 2020

Iran-linked Chafer APT group targets governments in Kuwait and Saudi Arabia
May 21, 2020
https://securityaffairs.co/wordpress/103556/apt/chafer-apt-kuwait-saudi-arabia.html

Cybersecurity researchers from Bitdefender published a detailed report on an Iranian cyber espionage campaign directed against critical infrastructures in Kuwait and Saudi Arabia.

The Chafer APT group has distributed data stealer malware since at least mid-2014, it was focused on surveillance operations and the tracking of individuals.

“Victims of the analyzed campaigns fit into the pattern preferred by this actor, such as air transport and government sectors in the Middle East,” reads the researcher paper published by the experts.
The attackers used several tools, including ‘living off the land’ tools, making it hard to attribute the attack to specific threat actors, as well as a custom-built backdoor.
Click to expand...

Bitdefender: Iranian Chafer APT Targeted Air Transportation and Government in Kuwait and Saudi Arabia

Log in or Sign up

Iran-Linked Chafer Group Expands Toolset, Targets List

itman Registered Member

itman Registered Member

guest Guest

guest Guest

Log in or Sign up

Iran-Linked Chafer Group Expands Toolset, Targets List

itman Registered Member

itman Registered Member

guest Guest

guest Guest

Useful Searches