Menu
Researchers dismantle decade-long Iranian cyberespionage operation

Researchers dismantle decade-long Iranian cyberespionage operation

The group infected more than 300 computers in 35 countries with information-stealing malware

The infrastructure used by an Iranian cyberespionage group to control infected computers around the world has been hijacked by security researchers.

Researchers from Palo Alto Networks came across the group's activities earlier this year, but found evidence that it has been operating since at least 2007. Its main tool is a custom malware program dubbed Infy, which was repeatedly improved over the years.

The researchers have worked with domain registrars to seize the domains used by the attackers to control Infy-infected computers and to direct victims' traffic to a sinkhole server -- a server the researchers controlled.

Control of the server was then transferred to the Shadowserver Foundation, an industry group that tracks botnets and works with ISPs and other parties to notify victims.

Sinkholing the command-and-control (C2) infrastructure took away the hackers' ability to steal data from victims, something they unsuccessfully tried to correct when they realized something is amiss.

The Palo Alto researchers observed 326 Infy-infected computers in 35 countries, with almost half of them being located in Iran. This suggests that the hacker group was focused on Iranian citizens, possibly for surveillance purposes.

The total number of victims is relatively low compared to cybercrimine campaigns, but not unusual for cyberespionage operations, which are by definition targeted in nature.

About 50 percent of victims were infected with both Infy and Infy M, a more recent and capable variant of the malware, suggesting that those victims might have been high-value targets worthy of more attention.

It's likely that the Infy group will return with new attack campaigns in the future, but it won't be easy to rebuild their infrastructure. Compromising the same targets again will also likely prove difficult, especially since Shadowserver has worked to notify victims.

Palo Alto Networks has shared indicators of compromise and Infly sample hashes so the attackers will have to revamp their whole operation if they want to remain undetected in the future.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Featured

Slideshows

Female leaders honoured at Reseller News Women in ICT Awards in 2022

Female leaders honoured at Reseller News Women in ICT Awards in 2022

​Reseller News is proud to announce the winners of the Women in ICT Awards (WIICTA) in 2022, honouring female excellence within the technology channel following an industry-defining celebration in New Zealand.

Female leaders honoured at Reseller News Women in ICT Awards in 2022
Bumper channel crowd kicks off Reseller News Women in ICT Awards

Bumper channel crowd kicks off Reseller News Women in ICT Awards

A record-breaking channel crowd came together to kick-start an expanded Women in ICT Awards (WIICTA) in 2022, honouring female excellence within the technology ecosystem following an industry-defining celebration in New Zealand.

Bumper channel crowd kicks off Reseller News Women in ICT Awards
Show Comments