Menu
Researchers dismantle decade-long Iranian cyberespionage operation

Researchers dismantle decade-long Iranian cyberespionage operation

The group infected more than 300 computers in 35 countries with information-stealing malware

The infrastructure used by an Iranian cyberespionage group to control infected computers around the world has been hijacked by security researchers.

Researchers from Palo Alto Networks came across the group's activities earlier this year, but found evidence that it has been operating since at least 2007. Its main tool is a custom malware program dubbed Infy, which was repeatedly improved over the years.

The researchers have worked with domain registrars to seize the domains used by the attackers to control Infy-infected computers and to direct victims' traffic to a sinkhole server -- a server the researchers controlled.

Control of the server was then transferred to the Shadowserver Foundation, an industry group that tracks botnets and works with ISPs and other parties to notify victims.

Sinkholing the command-and-control (C2) infrastructure took away the hackers' ability to steal data from victims, something they unsuccessfully tried to correct when they realized something is amiss.

The Palo Alto researchers observed 326 Infy-infected computers in 35 countries, with almost half of them being located in Iran. This suggests that the hacker group was focused on Iranian citizens, possibly for surveillance purposes.

The total number of victims is relatively low compared to cybercrimine campaigns, but not unusual for cyberespionage operations, which are by definition targeted in nature.

About 50 percent of victims were infected with both Infy and Infy M, a more recent and capable variant of the malware, suggesting that those victims might have been high-value targets worthy of more attention.

It's likely that the Infy group will return with new attack campaigns in the future, but it won't be easy to rebuild their infrastructure. Compromising the same targets again will also likely prove difficult, especially since Shadowserver has worked to notify victims.

Palo Alto Networks has shared indicators of compromise and Infly sample hashes so the attackers will have to revamp their whole operation if they want to remain undetected in the future.


Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Featured

Slideshows

Sizing up the NZ security spectrum - Where's the channel sweet spot?

Sizing up the NZ security spectrum - Where's the channel sweet spot?

From new extortion schemes, outside threats and rising cyber attacks, the art of securing the enterprise has seldom been so complex or challenging. With distance no longer a viable defence, Kiwi businesses are fighting to stay ahead of the security curve. In total, 28 per cent of local businesses faced a cyber attack last year, with the number in New Zealand set to rise in 2017. Yet amidst the sensationalism, media headlines and ongoing high profile breaches, confusion floods the channel, as partners seek strategic methods to combat rising sophistication from attackers. In sizing up the security spectrum, this Reseller News roundtable - in association with F5 Networks, Kaspersky Lab, Tech Data, Sophos and SonicWall - assessed where the channel sweet spot is within the New Zealand channel. Photos by Maria Stefina.

Sizing up the NZ security spectrum - Where's the channel sweet spot?
Kiwi channel comes together for another round of After Hours

Kiwi channel comes together for another round of After Hours

The channel came together for another round of After Hours, with a bumper crowd of distributors, vendors and partners descending on The Jefferson in Auckland. Photos by Maria Stefina.​

Kiwi channel comes together for another round of After Hours
Show Comments