Iranian Hacking Group Found Hosting C2 Infrastructure in the US
The activity was identified by cybersecurity researchers at Semperis, who published their findings on October 22 .
However, information in the Tornado malware resulted in researchers being able to identify where the campaign was being hosted and it was found to be a US hosting company.
Forms of malware identified as part of the latest Prince of Persia campaign include Foudre, a first stage malware loader and Tonnerre, a second stage malware which provides the attackers with what researchers describe as full surveillance capabilities.
Prince of Persia has been known to secretly hide its activity on European hosting services and virtual private servers, but anti-detection capabilities of the malware initially made it difficult for researchers to identify how the latest campaign was being hosted.
The multiple forms of malware used in Prince of Persia campaigns provide attackers with intrusive data exfiltration capabilities.
Prince of Persia targets public and private sector organisations across the US, Europe and the Middle East, as well as dissidents and others opposed to the Iranian regime.
While it isn’t unusual for threat groups to hide their activity within US hosting providers, it is the first time an Iranian threat group has been identified as hosting their activity on US servers in at least 12 years.
This includes the ability to steal sensitive documents, as well as secretly taking screenshots and capturing audio recorded by the infected device.
The campaigns also involve a more recently identified malware known as Tornado, which builds on the codebase of previous malware.
Tornado has the ability to use both HTTPS and the Telegram API as a covert C2 channel, blending in with legitimate network traffic to bypass firewalls and evade detection.
To help ensure protection from attacks by the group, Semperis has recommended the following actions:
What happened
However, information in the Tornado malware resulted in researchers being able to identify where the campaign was being hosted and it was found to be a US hosting company.
Forms of malware identified as part of the latest Prince of Persia campaign include Foudre, a first stage malware loader and Tonnerre, a second stage malware which provides the attackers with what researchers describe as full surveillance capabilities.
What changed
Prince of Persia has been known to secretly hide its activity on European hosting services and virtual private servers, but anti-detection capabilities of the malware initially made it difficult for researchers to identify how the latest campaign was being hosted.
The multiple forms of malware used in Prince of Persia campaigns provide attackers with intrusive data exfiltration capabilities.
Who is affected
Prince of Persia targets public and private sector organisations across the US, Europe and the Middle East, as well as dissidents and others opposed to the Iranian regime.
While it isn’t unusual for threat groups to hide their activity within US hosting providers, it is the first time an Iranian threat group has been identified as hosting their activity on US servers in at least 12 years.
Why it matters
This includes the ability to steal sensitive documents, as well as secretly taking screenshots and capturing audio recorded by the infected device.
Technical details
The campaigns also involve a more recently identified malware known as Tornado, which builds on the codebase of previous malware.
Tornado has the ability to use both HTTPS and the Telegram API as a covert C2 channel, blending in with legitimate network traffic to bypass firewalls and evade detection.
Response
To help ensure protection from attacks by the group, Semperis has recommended the following actions:
Attribution
Infosecurity Magazine: The activity was identified by cybersecurity researchers at Semperis, who published their findings on October 22 .