Iranian APT is targeting Middle Eastern Aerospace and Telecommunications companies

For a detailed advisory, download the pdf file here.

ShellClient is a powerful new Remote Access Trojan (RAT) that was used in highly targeted attacks on a select few Aerospace and Telecommunications firms, primarily in the Middle East, with other victims in the United States, Russia, and Europe. The attacks were carried out by a newly uncovered Iranian activity group known as MalKamak, which has been active since at least 2018 but has remained unknown until now. ShellClient follows the trend of abusing cloud-based storage services, in this case the popular Dropbox service. The programmers of ShellClient decided to leave their old C2 domain and replace the malware’s C2 mechanism with a simpler C2 channel to exfiltrate stolen data and deliver commands to the malware.

The techniques used by ShellClient includes:

T1049 – System Network Connections Discovery

T1566 – Phishing

T1102 – Web Service

T1036 – Masquerading

T1003 – OS Credential Dumping

T1040 – Network Sniffing

T1543 – Create or Modify System Process

T1127 – Trusted Developer Utilities Proxy Execution

T1560 – Archive Collected Data

Actor Details

Indicators of Compromise (IoCs)

References