Threat actors with suspected ties to Iran have been found to
leverage instant messaging and VPN apps like Telegram and Psiphon
to install a Windows remote access trojan (RAT) capable of stealing
sensitive information from targets’ devices since at least
2015.
Russian cybersecurity firm Kaspersky, which pieced together the
activity, attributed the campaign to an advanced persistent threat
(APT) group it tracks as Ferocious Kitten, a group that has singled
out Persian-speaking individuals allegedly based in the country
while successfully operating under the radar.
“The targeting of Psiphon and Telegram, both of which are quite
popular services in Iran, underlines the fact that the payloads
were developed with the purpose of targeting Iranian users in
mind,” Kaspersky’s Global Research and Analysis Team (GReAT)
said[1].
“Moreover, the decoy content displayed by the malicious files
often made use of political themes and involved images or videos of
resistance bases or strikes against the Iranian regime, suggesting
the attack is aimed at potential supporters of such movements
within the country.”
Kaspersky’s findings emerge from two weaponized documents that
were uploaded to VirusTotal in July 2020 and March 2021 that come
embedded with macros, which, when enabled, drop next-stage payloads
to deploy a new implant called MarkiRat.
The backdoor allows adversaries broad access to a victim’s
personal data, comprising features to record keystrokes, capture
clipboard content, download and upload files, as well as the
ability to execute arbitrary commands on the victim machine.
In what appears to be an attempt to expand their arsenal, the
attackers also experimented with different variants of MarkiRat
that were found to intercept the execution of apps like Google
Chrome and Telegram to launch the malware and keep it persistently
anchored to the computer at the same time also making it much
harder to be detected or removed. One of the discovered artifacts
also includes a backdoored version of Psiphon; an open-source VPN
tool often used to evade internet censorship.
Another recent variant involves a plain downloader that
retrieves an executable from a hardcoded domain, with the
researchers noting that the “use of this sample diverges from those
used by the group in the past, where the payload was dropped by the
malware itself, suggesting that the group might be in the process
of changing some of its TTPs.”
What’s more, the command-and-control infrastructure is also said
to have hosted Android applications in the form of DEX and APK
files, raising the possibility that the threat actor is also
simultaneously developing malware aimed at mobile users.
Interestingly, the tactics adopted by the adversary overlap with
other groups that operate against similar targets, such as Domestic
Kitten and Rampant Kitten, with Kaspersky finding parallels in the
way the actor used the same set of C2 servers over extended periods
of time and attempted to gather information from KeePass password
manager.
“Ferocious Kitten is an example of an actor that operates in a
wider ecosystem intended to track individuals in Iran,” the
researchers concluded. “Such threat groups do not appear to be
covered that often and can therefore get away with casually reusing
infrastructure and toolsets without worrying about them being taken
down or flagged by security solutions.”