Nazar: Old Iran-Linked APT Operation Monitored by NSA

guest · May 6, 2020

Nazar: Old Iran-Linked APT Operation Monitored by NSA
April 23, 2020
https://www.securityweek.com/nazar-old-iran-linked-apt-operation-monitored-nsa

The campaign, which was previously attributed to Chinese threat actor Emissary Panda, which is also referred to as APT27, LuckyMouse, BRONZE UNION, and Threat Group 3390, is referenced in one of the files from the Shadow Brokers dump as SIG37.

According to Juan Andres Guerrero-Saade, a security researcher who previously worked for Kaspersky and Google, SIG37 in fact points to a previously unidentified cluster of activity that might be going back as far as 2008. He has not been able to link this activity to any known threat group.
The researcher, who refers to the operation as ‘Nazar’, based on “debug paths left alongside Farsi resources in some of the malware droppers,” believes that the activity was centered around the 2010-2013 timeframe, based on submission times in VirusTotal.

“Somehow, this operation found its way onto the NSA’s radar pre-2013,” Guerrero-Saade wrote in a blog post on Nazar. “As far as I can tell, it’s eluded specific coverage from the security industry.
Click to expand...

The malware leverages libraries to implement screen grabbing, microphone recording, and keylogging features, while two custom resources, which are treated as type libraries and registered as OLE controls, can enumerate attached drives, traverse folder structures, and handle some C&C functionality.

A kernel driver is used to sniff packets from the victim machine’s interfaces and parse them for specific strings, but the researcher says he could not identify what it is parsing.
Click to expand...

Nazar: A Lost Amulet

SIG37 has proven a rewarding mystery, unearthing a previously undiscovered subset of activity worthy of our attention. Apart from several places where more skilled reverse engineers can contribute to better understanding the samples already discovered, there’s an opportunity for threat hunters with access to diverse data sets and systems to figure out just how big this iceberg really is. Are we looking at an internal surveillance framework? Is this part of an already known cluster of activity? Or can we add another predatory animal to our overpopulated zoo?
Click to expand...

guest · May 6, 2020

mood said: ↑

Nazar: A Lost Amulet
Click to expand...

Update #4 (05.05.2020): Amazing in-depth analysis of Nazar components by Itay Cohen from Checkpoint available here.
Click to expand...

Nazar: Spirits of the Past
May 5, 2020
https://research.checkpoint.com/2020/nazar-spirits-of-the-past/

The plethora of information exposed in the fifth and last leak by the Shadow Brokers, called “Lost in Translation”, and the following consequences that took shape in WannaCry and NotPetya among other things, makes this a changing point in the game of cyber security as we know it.

Recently, security researcher Juan Andres Guerrero-Saade revealed a previously misidentified and unknown threat group, called Nazar, which was part of the last leak by the Shadow Brokers. In this research, we will expand upon the analysis done by Juan and another which was written by Maciej Kotowicz, and will provide an in-depth analysis of each of the Nazar components.

But the real question is, do those new revelations add a missing piece to the puzzle, or do they show us how much of the puzzle we are missing?
Click to expand...

As we have shown in the article, the quality of the code, as well as the heavy usage of open source libraries, does not match the profile of a shrewd threat actor. And although we tried to cover everything, there are still many unanswered questions surrounding those discoveries: What happened to the Nazar group, did they evolve into other groups that are nowadays known under different names? Are they still active? Are there more samples out there? With those questions and others on our minds, we cannot help but leave this open-ended.
Click to expand...

Log in or Sign up

Nazar: Old Iran-Linked APT Operation Monitored by NSA

guest Guest

guest Guest

Log in or Sign up

Nazar: Old Iran-Linked APT Operation Monitored by NSA

guest Guest

guest Guest

Useful Searches