Menu
Researchers dismantle decade-long Iranian cyberespionage operation

Researchers dismantle decade-long Iranian cyberespionage operation

The group infected more than 300 computers in 35 countries with information-stealing malware

The infrastructure used by an Iranian cyberespionage group to control infected computers around the world has been hijacked by security researchers.

Researchers from Palo Alto Networks came across the group's activities earlier this year, but found evidence that it has been operating since at least 2007. Its main tool is a custom malware program dubbed Infy, which was repeatedly improved over the years.

The researchers have worked with domain registrars to seize the domains used by the attackers to control Infy-infected computers and to direct victims' traffic to a sinkhole server -- a server the researchers controlled.

Control of the server was then transferred to the Shadowserver Foundation, an industry group that tracks botnets and works with ISPs and other parties to notify victims.

Sinkholing the command-and-control (C2) infrastructure took away the hackers' ability to steal data from victims, something they unsuccessfully tried to correct when they realized something is amiss.

The Palo Alto researchers observed 326 Infy-infected computers in 35 countries, with almost half of them being located in Iran. This suggests that the hacker group was focused on Iranian citizens, possibly for surveillance purposes.

The total number of victims is relatively low compared to cybercrimine campaigns, but not unusual for cyberespionage operations, which are by definition targeted in nature.

About 50 percent of victims were infected with both Infy and Infy M, a more recent and capable variant of the malware, suggesting that those victims might have been high-value targets worthy of more attention.

It's likely that the Infy group will return with new attack campaigns in the future, but it won't be easy to rebuild their infrastructure. Compromising the same targets again will also likely prove difficult, especially since Shadowserver has worked to notify victims.

Palo Alto Networks has shared indicators of compromise and Infly sample hashes so the attackers will have to revamp their whole operation if they want to remain undetected in the future.


Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Featured

Slideshows

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

​Ingram Micro’s Hooked on Lenovo incentive programme recently rewarded 28 of New Zealand's top performing resellers with a full-on fishing trip at Great Barrier Island for the third year​ in a row.

Tight lines as Hooked on Lenovo catches up at Great Barrier Island
Inside the AWS Summit in Sydney

Inside the AWS Summit in Sydney

As the dust settles on the 2017 AWS Summit in Sydney, ARN looks back an action packed two-day event, covering global keynote presentations, 80 breakout sessions on the latest technology solutions, and channel focused tracks involving local cloud stories and insights.

Inside the AWS Summit in Sydney
Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Ingram Micro hosted its third annual Cure Kids Charity Golf Tournament at the North Shore Golf Club in Auckland. In total, 131 resellers, vendors and Ingram Micro suppliers enjoyed a round of golf consisting of challenges on each of the 18 sponsored holes, with Team Philips taking out the top honours.

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day
Show Comments