APT34 Unleashes Stealthy Malware Targeting Financial and Telecom Sectors

Iranian APT34 Expands Cyber Espionage Operations with Advanced Evasion Techniques

Overview

An advanced cyber espionage campaign linked to the Iranian state-sponsored hacking group APT34 (OilRig) has been actively targeting Iraqi government agencies and critical infrastructure since late 2024. The attackers have deployed newly developed malware strains engineered to bypass conventional security defenses.

APT34, operational since 2012, has widened its attack scope to include financial institutions and telecommunications providers across the Middle East, reflecting a shift in strategic priorities.

Attack Methodology

The campaign employs spear-phishing tactics, sending emails disguised as official Iraqi government correspondence. These messages contain malicious attachments that initiate multi-stage payload delivery while implementing environmental awareness checks to avoid sandbox detection.

Victims unknowingly execute disguised files, such as Ravateb.pdf.exe, which install backdoors capable of communicating via HTTP or hijacked email accounts for command-and-control (C2) operations.

Exploited Infrastructure

ThreatBook researchers uncovered evidence of over a dozen compromised Iraqi government email addresses being leveraged for lateral movement, including:

fadi.Al-shemary@pmo.gov.iq
investunit@pmo.gov.iq

Advanced Evasion and Persistence Techniques

The malware employs multi-layered obfuscation mechanisms, starting with position-based string mutations before decoding via Base64 and XOR decryption using a hardcoded key:

felkkf jerf43klt lkg ert#$ T#$t

This method generates unique patterns with each execution, making static signature-based detection ineffective.

Decryption Logic

The malware’s decoding function systematically removes specific characters before applying XOR decryption:

def decode_FromC2(input_str):
    if len(input_str) > 12:
        input_str = input_str[:12] + input_str[13:]
    if len(input_str) > 7:
        input_str = input_str[:7] + input_str[8:]
    if len(input_str) > 5:
        input_str = input_str[:5] + input_str[6:]
    if len(input_str) > 2:
        input_str = input_str[:2] + input_str[3:]
    if len(input_str) > 0:
        input_str = input_str[1:]
    return xor_base64(input_str)

Post-infection, the malware ensures persistence through a Windows service named MonitorUpdate, which executes at randomized intervals between 60 to 120 minutes. Additionally, it manipulates file timestamps to resemble legitimate system binaries and performs the following environment checks:

Confirms at least four non-shortcut files exist on the desktop.
Ensures system uptime exceeds three months.
Examines motherboard details to detect virtualized environments.

C2 Infrastructure & Communication

Once fully operational, the malware connects to C2 servers hosted in Europe via TCP ports 10443 and 8989, using endpoints like /resource and /document for data exfiltration.

The malware’s configuration file (windowsObject.exe.config) enables modular adaptability:

<appSettings>
    <add key="P" value="10443" />
    <add key="lower_sec" value="60" />
    <add key="upper_sec" value="120" />
    <add key="I" value="UXClxFCHX11IJEllWXFQHCg==" />
</appSettings>

APT34’s Evolving Infrastructure

APT34 maintains a decentralized C2 network leveraging European hosting providers. Identified nodes include:

Norway: 89.46.233.239
Germany: 151.236.17.231

Additionally, the group employs domain generation algorithms (DGAs) that incorporate regional keywords such as iqwebservice and asiacall to craft convincing domain names.

Conclusion

This latest campaign highlights APT34’s growing sophistication in cyber espionage, blending credential harvesting with cutting-edge cryptographic evasion. While ThreatBook’s detection services, including its Threat Detection Platform (TDP) and OneDNS, offer coverage for identified indicators of compromise, behavioral analysis remains essential in countering this adaptable malware.

CYPHERLOCK, INC.