Iranian hackers believed to be behind Shamoon data-wiping malware

A spate of late assaults involving the Shamoon data-wiper malware family has been credited to the Iranian hacking group APT33.

On Wednesday, the McAfee Advanced Threat Research group said APT33 – or a group taking on the appearance of APT33 – is likely in charge of an ongoing campaign which targeted industrial players in the Middle East and Europe.

McAfee said in a blog post that ongoing Shamoon-based campaigns have been detected not only focusing on organizations directly but also been utilized in supply chain attacks. Shamoon is an extremely dangerous malware intended to wipe tainted frameworks by overwriting information with junk data.

Two adaptations of the malware have been recorded in past years. The earliest occurrence involving Shamoon took place in 2012 against the Saudi Aramco oil organization – resulting in wipe of 30,000 PCs – while over 2016 and 2017, both an upgraded Shamoon v.2 wiper and the Stonedrill wiper were used.

In these cases, tainted frameworks were additionally smeared with propaganda, including images of the burning American flag and a drowned Syrian child.

In the course of recent weeks, another variation of Shamoon has been discovered assaulting oil, gas, energy, telecom, and government associations by job offer-related phishing campaigns and vindictive sites which trap victims into submitting their account credentials.

The most recent variant of Shamoon has been revamped in a modular fashion, containing various diverse features. The new wiper samples come under the name Filerase.

Contained in the malware is a rundown of targeted PCs, a spreader for the file eraser, code able to exfiltrate information relating to a target PC’s operating system, a remote wiper execution module, and the new wiper itself, which deletes every file found upon execution.

The wiper contains three options; running in silent mode, an always-enabled privilege escalation script, and a tracker to record the number of folders and files erased.

While the most recent version of Shamoon is vigorously encrypted, the packaged .Net toolkit that spreads Shamoon v.3 and Filerase has not been granted such protection. After reverse engineering the package, which was not muddled, the specialists found the accompanying ASCII workmanship which resembles Arabic content from the Quran translated as “perish the hands of the Father of flame” or “the power of Abu Lahab will perish, and he will perish.”

McAfee believes that multiple developers were engaged with the most recent Shamoon crusade, which was “prepared months in advance [..] with the wiper execution as the goal.”

“Attributing this attack is difficult because we do not have all the pieces of the puzzle,” McAfee says. “We do see that this attack is in line with the Shamoon v.2 techniques. Political statements have been a part of every Shamoon attack. […] Now we see a verse from the Quran, which might indicate that the adversary is related to another Middle Eastern conflict and wants to make a statement.”

It is absolutely conceivable that Iranian programmers could be at the base of the issue, particularly considering the ongoing political pressures between the nation and the United States. President Trump announced the withdrawal of the US from the 2015 atomic deal, built up by the Obama Administration, back in May.

While numerous cyberattacks credited to Iran have focused in past years on the Middle East, stewing political strains have raised theory that their gaze may turn towards the US in future crusades.

Leave a Reply

Your email address will not be published. Required fields are marked *

Single Column Posts

Single Column Posts Subtitle