Iran and the Soft Warfor Internet Dominance
Claudio Guarnieri (@botherder) & Collin Anderson (@cda)

Who we are• Nex• Technologist at Amnesty
International.
• Senior Research Fellow atCitizenLab.
• Creator of Cuckoo Sandbox, Viper,
Malwr.com …

• Cda• Networked systems researcher,based in Washington, D.C.
• Collaborates with civil society onInternet measurement and policy
issues (e.g. Wassenaar), academic
institutions, and others.
• History on Iran human rights andforeign policy.

The Green Movement and the Soft WarShedding Light on the Targeting ofActivists and At-Risk CommunitiesMission
Collect Samples and Incidents from Targets of Iran-based
Intrusion Campaigns for Accountability and Community
Education.

Intrusions and ElectionsPhishing and Malware, the New Normal

Mandatory Grugq Quote

Campaigns, Tools and Actors
Cross section of the Ecosystem

InfyDGA \o/• They implemented a bizarre DGA algorithm• It would use rotating pools of 30 domains.
• The DGA domains are contacted even if primary C&C is up.
• Only one registered before, all the others available.
• Started sinkholing from December 2015.

Professional Sinkhole CamouflageHello hello!

Update system• When the malware checks in with the C&C, it retrieves instructions.
• If the C&C replies to the HTTP request with a 302 Redirect to a given
URL pointing to an .exe, Infy will download and execute it.
• No verification or signing, and…
• The DGA domains are obviously able to distribute updates…

Infy: summing up• Very active group, will probably resurface.
• Rudimentary development skills.
• Decent social engineering skills.
• Worst OPSEC ever?
• Very, very successful. Managed to compromise several hundreds oftargets.

Cleaver (Ghambar)

private static void Main(){try{
Utils.DbgPrint(".: In the name of God :.");
string destinationPathOfExecution =IoPathUtils.GetDestinationPathOfExecution();string text =Path.Combine(destinationPathOfExecution,Resources.APP_EXE_FILE_NAME);
if (!Directory.Exists(destinationPathOfExecution)){
Directory.CreateDirectory(destinationPathOfExecution);}

Features• Self-destruct• Shell• Screenshot;• Shutdown computer• Reboot computer• Logoff user
• Lock computer• Set and copy clipboard• Turn on and off display• Enable/disable mouse and keyboard (not implemented)• “Enable or disable desktop” (not implemented)• Trigger BSOD (not implemented)

Some neat little things…
• The keylogger doesn’t store anything on disk, unless the C&C isunreachable. Then removes the logs when submitted.

Some neat little things…
• The keylogger doesn’t store anything on disk, unless the C&C isunreachable. Then removes the logs when submitted.
• Ghambar is entirely modular. It’s able to download and execute newplugins.
• Uses a SOAP-based protocol for communicating to the C&C, verysimilar to Operation Cleaver’s TinyZBot.
• The samples we obtained appear to be under development. Ghambar might
be the next generation implant from Cleaver?

Cleaver: summing up• Active in comprosing legitimate hosts, doing watering hole attacks.
• Rudimentary programming skills, but improving.

Rocket Kitten

Then the attacker would…
1. Install a first stage .exe with persistence, that would launch aPowerShell command.
2. PowerShell commands would inject some code and execute it.
3. At the end of the chain, the code would download a MeterpreterDLL and launch it as a reverse shell.

Then the attacker would…
1. Install a first stage .exe with persistence, that would launch aPowerShell command.
2. PowerShell commands would inject some code and execute it.
3. At the end of the chain, the code would download a Meterpreter
DLL and launch it as a reverse shell.

1. Yes, they totally connected into our VM and when
figured it wasn’t legit, started frenetically deleting stuff
and rebooting it.

WTF?
• Been burning Telegram API keys like there’s no tomorrow.
• Fetching user IDs for Iranian phone numbers in mass.
• More than between 15 and 20 million.

• Useful for reconstructing networks and perhaps deanonymizing users
when someone’s phone is confiscated?

Rocket: summing up• Diverse activities.
• Interesting tricks, experienced attacker.
• Seem verse in using Metasploit. They’ve been observed before using
Core Impact Pro.
• Very active, probably one of the most concerning groups.

SimaTools & Techniques• We’ve seen Sima using two different droppers• One worked terribly, had logic flaws, and had endless loops of flashingcmd.exe attempting to call reg command to gain persistence.
• One much better designed, using task scheduler for persistence, anderrors/dialogs suppression.

• Both would then instantiate a legitimate RegAsm.exe, do process
hollowing, and inject it with Luminosity Link code.

Sima: summing up• Excellent recon skills• Excellent social engineering skills• Good organization• Bad OPSEC• Bad development skills• Still, successful.

Coming to an end…

Conclusions• Dearth of information of historical campaigns, but Iranians have been thesubject of targeted intrusion by their government since at least early 2010.
• Intrusions and disruptions are conducted by disparate groups concurrent toeach other with evolving strategies.
• Most observed incidents evince low to medium sophistication, primarily
relying on social engineering.
• Same toolkits used against civil society as in espionage against foreign
targets.
• Intrusions are common and normalized, but large surface area forsurveillance due to low technical expertise.

Next steps• Document the capabilities and campaigns associated with Iranianthreat actors.
• Resurface evidence of previous campaigns prior to June 2013.
• Collect harm stories and case studies of intrusion attempts.
• Provide background narratives of actors and intrusions over time.
• Publish full research and datasets, including samples, hashes andIOCs.
• Coordinate further disclosure and remediation of campaigns.

Thank you!
Claudio Guarnieri (@botherder) & Collin Anderson (@cda)