Menu
Researchers dismantle decade-long Iranian cyberespionage operation

Researchers dismantle decade-long Iranian cyberespionage operation

The group infected more than 300 computers in 35 countries with information-stealing malware

The infrastructure used by an Iranian cyberespionage group to control infected computers around the world has been hijacked by security researchers.

Researchers from Palo Alto Networks came across the group's activities earlier this year, but found evidence that it has been operating since at least 2007. Its main tool is a custom malware program dubbed Infy, which was repeatedly improved over the years.

The researchers have worked with domain registrars to seize the domains used by the attackers to control Infy-infected computers and to direct victims' traffic to a sinkhole server -- a server the researchers controlled.

Control of the server was then transferred to the Shadowserver Foundation, an industry group that tracks botnets and works with ISPs and other parties to notify victims.

Sinkholing the command-and-control (C2) infrastructure took away the hackers' ability to steal data from victims, something they unsuccessfully tried to correct when they realized something is amiss.

The Palo Alto researchers observed 326 Infy-infected computers in 35 countries, with almost half of them being located in Iran. This suggests that the hacker group was focused on Iranian citizens, possibly for surveillance purposes.

The total number of victims is relatively low compared to cybercrimine campaigns, but not unusual for cyberespionage operations, which are by definition targeted in nature.

About 50 percent of victims were infected with both Infy and Infy M, a more recent and capable variant of the malware, suggesting that those victims might have been high-value targets worthy of more attention.

It's likely that the Infy group will return with new attack campaigns in the future, but it won't be easy to rebuild their infrastructure. Compromising the same targets again will also likely prove difficult, especially since Shadowserver has worked to notify victims.

Palo Alto Networks has shared indicators of compromise and Infly sample hashes so the attackers will have to revamp their whole operation if they want to remain undetected in the future.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments