Menu
Researchers dismantle decade-long Iranian cyberespionage operation

Researchers dismantle decade-long Iranian cyberespionage operation

The group infected more than 300 computers in 35 countries with information-stealing malware

The infrastructure used by an Iranian cyberespionage group to control infected computers around the world has been hijacked by security researchers.

Researchers from Palo Alto Networks came across the group's activities earlier this year, but found evidence that it has been operating since at least 2007. Its main tool is a custom malware program dubbed Infy, which was repeatedly improved over the years.

The researchers have worked with domain registrars to seize the domains used by the attackers to control Infy-infected computers and to direct victims' traffic to a sinkhole server -- a server the researchers controlled.

Control of the server was then transferred to the Shadowserver Foundation, an industry group that tracks botnets and works with ISPs and other parties to notify victims.

Sinkholing the command-and-control (C2) infrastructure took away the hackers' ability to steal data from victims, something they unsuccessfully tried to correct when they realized something is amiss.

The Palo Alto researchers observed 326 Infy-infected computers in 35 countries, with almost half of them being located in Iran. This suggests that the hacker group was focused on Iranian citizens, possibly for surveillance purposes.

The total number of victims is relatively low compared to cybercrimine campaigns, but not unusual for cyberespionage operations, which are by definition targeted in nature.

About 50 percent of victims were infected with both Infy and Infy M, a more recent and capable variant of the malware, suggesting that those victims might have been high-value targets worthy of more attention.

It's likely that the Infy group will return with new attack campaigns in the future, but it won't be easy to rebuild their infrastructure. Compromising the same targets again will also likely prove difficult, especially since Shadowserver has worked to notify victims.

Palo Alto Networks has shared indicators of compromise and Infly sample hashes so the attackers will have to revamp their whole operation if they want to remain undetected in the future.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Featured

Slideshows

EDGE 2018: Kiwis kick back with Super Rugby before NZ session

EDGE 2018: Kiwis kick back with Super Rugby before NZ session

New Zealanders kick-started EDGE 2018 with a bout of Super Rugby before a dedicated New Zealand session, in front of more than 50 partners, vendors and distributors on Hamilton Island.​

EDGE 2018: Kiwis kick back with Super Rugby before NZ session
EDGE 2018: Kiwis assess key customer priorities through NZ research

EDGE 2018: Kiwis assess key customer priorities through NZ research

EDGE 2018 kicked off with a dedicated New Zealand track, highlighting the key customer priorities across the local market, in association with Dell EMC. Delivered through EDGE Research - leveraging Kiwi data through Tech Research Asia - more than 50 partners, vendors and distributors combined during an interactive session to assess the changing spending patterns of the end-user and the subsequent impact to the channel.

EDGE 2018: Kiwis assess key customer priorities through NZ research
Show Comments