Iranian Government Entities Under Attack by New Wave of BackdoorDiplomacy Attacks

Jan 18, 2023Ravie LakshmananCyber Espionage / Cyber Risk

The threat actor known as BackdoorDiplomacy has
been linked to a new wave of attacks targeting Iranian government
entities between July and late December 2022.

Palo Alto Networks Unit 42, which is tracking the activity under
its constellation-themed^[1]
moniker Playful Taurus, said it observed the
government domains attempting to connect to malware infrastructure
previously identified as associated with the adversary.

Also known by the names APT15, KeChang, NICKEL, and Vixen Panda,
the Chinese APT group has a history of cyber espionage campaigns
aimed at government and diplomatic entities across North America,
South America, Africa, and the Middle East at least since 2010.

Slovak cybersecurity firm ESET, in June 2021, unpacked^[2]
the intrusions mounted by hacking crew against diplomatic entities
and telecommunication companies in Africa and the Middle East using
a custom implant known as Turian.

Then in December 2021, Microsoft announced^[3]
the seizure of 42 domains operated by the group in its attacks
targeting 29 countries, while pointing out its use of exploits
against unpatched systems to compromise internet-facing web
applications such as Microsoft Exchange and SharePoint.

The threat actor was most recently attributed to an attack on an
unnamed telecom company in the Middle East using Quarian^[4], a predecessor of Turian
that allows a point of remote access into targeted networks.

Turian “remains under active development and we assess that it
is used exclusively by Playful Taurus actors,” Unit 42 said^[5]
in a report shared with The Hacker News, adding it discovered new
variants of the backdoor used in attacks singling out Iran.

The cybersecurity company further noted that it observed four
different Iranian organizations, including the Ministry of Foreign
Affairs and the Natural Resources Organization, reaching out to a
known command-and-control (C2) server attributed to the group.

“The sustained daily nature of these connections to Playful
Taurus controlled infrastructure suggests a likely compromise of
these networks,” it said.

The new versions of the Turian backdoor sport additional
obfuscation as well as an updated decryption algorithm used to
extract the C2 servers. However, the malware in itself is generic
in that it offers basic functions to update the C2 server to
connect to, execute commands, and spawn reverse shells.

BackdoorDiplomacy’s interest in targeting Iran is said to have
geopolitical extensions as it comes against the backdrop of a
25-year comprehensive cooperation agreement^[6]
signed between China dn Iran to foster economic, military, and
security cooperation.

“Playful Taurus continues to evolve their tactics and their
tooling,” researchers said. “Recent upgrades to the Turian backdoor
and new C2 infrastructure suggest that these actors continue to see
success during their cyber espionage campaigns.”