Source code of Iranian cyber-espionage tools leaked on Telegram

guest · Apr 18, 2019

Source code of Iranian cyber-espionage tools leaked on Telegram
APT34 hacking tools and victim data leaked on a secretive Telegram channel since last month
April 17, 2019
https://www.zdnet.com/article/source-code-of-iranian-cyber-espionage-tools-leaked-on-telegram/

In an incident reminiscent of the Shadow Brokers leak that exposed the NSA's hacking tools, someone has now published similar hacking tools belonging to one of Iran's elite cyber-espionage units, known as APT34, Oilrig, or HelixKitten.

The hacking tools are nowhere near as sophisticated as the NSA tools leaked in 2017, but they are dangerous nevertheless.
VICTIM DATA ALSO DUMPED ONLINE
The tools have been leaked since mid-March on a Telegram channel by an individual using the Lab Dookhtegan pseudonym.

In total, according to Chronicle, Dookhtegan leaked data from 66 victims, mainly from countries in the Middle East, but also Africa, East Asia, and Europe.
Data was taken from both government agencies, but also from private companies.
Click to expand...

guest · Apr 19, 2019

How companies – and the hackers themselves – could respond to the OilRig leak
April 18, 2019
https://www.cyberscoop.com/oilrig-leak-iran-telegram-helix-kitten/

In the last few weeks, hacking tools apparently used by a prolific Iran-linked group have been publicly leaked, exposing the hackers’ malicious code, the IP addresses of their servers, and their alleged victims.

While the ties of those individuals to OilRig has not been confirmed, a remote-access trojan and other tools, which have since been posted to GitHub, are authentic and employed by the group, researchers tell CyberScoop.
A cat-and-mouse game could follow the data dump, analysts say. With the malicious tools more squarely in the public eye, companies could build better defenses, forcing the hackers to reconfigure some of their tools to meet their objectives.

“[T]his sort of insight into their tooling does give defenders a unique advantage and a unique way to begin detecting” some of these techniques, said Brandon Levene, head of applied intelligence at Alphabet’s Chronicle.
Click to expand...

guest · Apr 23, 2019

Iran-linked APT34: Analyzing the webmask project
April 23, 2019
https://securityaffairs.co/wordpress/84370/apt/iran-apt34-webmask-project.html

Security expert Marco Ramilli published the findings of a quick analysis of the webmask project standing behind the DNS attacks implemented by APT34 (aka OilRig and HelixKitten).
Thanks to the leaked source code it is now possible to check APT34 implementations and techniques.
Click to expand...

guest · Apr 30, 2019

Leak Reveals Iran’s Wildest Hacker Crew Stole 13,000 Passwords From 98 Organizations
April 30, 2019
https://www.forbes.com/sites/thomas...ds-from-across-98-organizations/#371281f67c41

Earlier this month, a prolific hacking group said to be sponsored by Iran had its cyber arsenal leaked.
Now researchers who've gone through the data dump claim the group was targeting 97 different organizations across 27 countries. Organizations on the Oil Rig hit list included government, media, energy, transportation, logistics and technology service providers.

And along the way, Oil Rig stole 13,000 stolen credentials for logging into targets' online services, according to an analysis released Tuesday by U.S. cybersecurity firm Palo Alto Networks.
Of the usernames and passwords pilfered by OilRig, many appeared to have been stolen from a single organization's Active Directory [...] the Holy Grail for any digital spy.

Looking at the OilRig files, Brandon Levene, head of applied intelligence at Chronicle, told Forbes that organizations who had failed to carry out basic hygiene were more susceptible to attack carried out by hackers with time and resources.
Click to expand...

Palo Alto Networks - Unit42: Behind the Scenes with OilRig

guest · May 3, 2019

APT34: Glimpse project
May 2, 2019
https://securityaffairs.co/wordpress/84836/apt/apt34-glimpse-project.html

The APT34 Glimpse project is maybe the most complete APT34 project known so far, the popular researcher Marco Ramilli analyzed it for us.

Indeed we might observe a File-based command and control (a quite unusual solution) structure, a VBS launcher, a PowerShell Payload and a covert channel over DNS engine. This last feature is the most appreciated characteristics attributed to APT34. But let’s move on and start a quick analysis on it.
[...]
With High probability we are facing a multi-modular attacking framework where on one side the DNS communication channel delivers commands to the target Agents and on the other side many control panels could be developed and attached to the DNS communication system.
Click to expand...

guest · Jun 3, 2019

New Iranian hacking tool leaked on Telegram
June 3, 2019
https://www.zdnet.com/article/new-iranian-hacking-tool-leaked-on-telegram/

A new hacking tool believed to have been in the arsenal of Iranian state hackers has been published today online, in a Telegram channel.
This new tool is named Jason and was published online earlier today in the same Telegram channel where the leaker -- going by the name of Lab Dookhtegan -- dumped the six other previous hacking tools.

According to security researcher Omri Segev Moyal, the Jason tool is a GUI utility for brute-forcing Microsoft Exchange email servers using pre-compiled lists of username and password combos.
But while the tools leaked in April had been seen in previous attacks before, the Jason tool that was shared today is completely new, at least for the security researchers who analyzed it today.
Click to expand...

itman · Jun 3, 2019

According to security researcher Omri Segev Moyal, the Jason tool is a GUI utility for brute-forcing Microsoft Exchange email servers using pre-compiled lists of username and password combos.
Click to expand...

Tool is probably quite effective based on the fact most SMBs are clueless as to implementing password lockout polices and measures.

guest · Jun 6, 2019

mood said: ↑

New Iranian hacking tool leaked on Telegram
June 3, 2019
https://www.zdnet.com/article/new-iranian-hacking-tool-leaked-on-telegram/
Click to expand...

Analyzing the APT34’s Jason project
June 6, 2019
https://securityaffairs.co/wordpress/86680/hacking/analyzing-apt34-jason-project.html

Jason is a graphic tool implemented to perform Microsoft exchange account brute-force in order to “harvest” the highest possible emails and accounts information.

Jason.exe representing the graphic user interface and the main visible tool. Microsoft.Exchange.WebService.dll which includes the real functionalities used by Jason.exe, it’s a Microsoft developed library, PassSamplewhich includes some patterns implementation of possible Passwords [...]
The used .dll provides a managed interface for developing .NET client applications that use EWS. By using the EWS Managed API, the developer can access almost all the information stored in an Office 365, Exchange Online, or Exchange Server mailbox.

On the other hand Jason project doesn’t share the main source code language with previous APT34 analyses, it doesn’t include DNS tricks and or DNS usage evidences, it doesn’t include distinguishing patterns or language mistakes, it have been recompiled on January 2019 but using older technology. As already discussed it shares just few code style similarities with Glimpse and WebMask.
Click to expand...

Log in or Sign up

Source code of Iranian cyber-espionage tools leaked on Telegram

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

itman Registered Member

guest Guest

Log in or Sign up

Source code of Iranian cyber-espionage tools leaked on Telegram

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

itman Registered Member

guest Guest

Useful Searches