A suspected Iranian threat activity cluster has been linked to attacks aimed at Israeli shipping, government, energy, and healthcare organizations.
All as components of an espionage-focused campaign that commenced in late 2020.
Mandiant is tracking the group under its uncategorized moniker UNC3890, it’s believed to conduct operations that align with Iranian interests.
Malware Infiltrates Big Platforms
The collected data may be leveraged to support various activities, from hack-and-leak to enabling kinetic warfare attacks.
Furthermore, intrusion of the group lead to the deployment of two proprietary pieces of malware a small efficient backdoor named SUGARBUSH.
Therefore, a credential stealer called SUGARDUMP exfiltrates password information to an email address associated with Gmail, ProtonMail, and Yahoo.
Logically, employed is a network of command-and-control (C2) servers that host fake login pages impersonating legitimate platforms.
Office 365, LinkedIn, and Facebook are designed to communicate with the targets.
More importantly, as a watering hole that may have singled out the shipping sector.
The watering hole, as of November 2021, was hosted on a login page of a legitimate Israeli shipping company.
Penetrative SUGERDUMP Reinforced
Reinforcing the malware transmitted preliminary data about the logged-in user to an attacker-controlled domain.
While the exact methodology for initial, access remains unknown, it’s suspected to involve a mix of watering holes.
Credential harvesting by masquerading as legitimate services, and fraudulent job offers for a software developer position at a data analytics firm LexisNexis.
One of UNC3890’s most recent endeavors to target victims includes the usage of a video commercial for AI-based robotic dolls, used as a lure to deliver SUGARDUMP.
SUGARBUSH, the second bespoke malware, works by establishing a connection with an embedded C2 server to execute arbitrary CMD commands issued by the attacker.
Bestowing the adversary full control over the victim’s environment upon gaining initial access.
Other tools used by UNC3890 include the Metasploit penetration testing software and Unicorn
A publicly available utility for conducting a PowerShell downgrade attack and injecting shellcode into memory.
The group’s connections to Iran stem from the use of Farsi language artifacts in the newest version of SUGARDUMP.
The consistent targeting of Israeli entities that dovetails with other Iranian threat actor clusters, and the usage of the NorthStar C2 Framework.
