Iranian APT Group Targets Governments in Kuwait and Saudi Arabia

Bitdefender said the intelligence-gathering operations were
conducted by Chafer APT^[1]
(also known as APT39^[2] or Remix Kitten), a
threat actor known for its attacks on telecommunication and travel
industries in the Middle East to collect personal information that
serves the country’s geopolitical interests.

“Victims of the analyzed campaigns fit into the pattern
preferred by this actor, such as air transport and government
sectors in the Middle East,” the researchers said in a report
(PDF)^[3] shared with The Hacker
News, adding at least one of the attacks went undiscovered for more
than a year and a half since 2018.

“The campaigns were based on several tools, including ‘living
off the land’ tools, which makes attribution difficult, as well as
different hacking tools and a custom-built backdoor.”

Known to be active since 2014, the Chafer APT has previously taken
aim at Turkish
government organizations and foreign diplomatic
entities based in Iran with the goal of exfiltrating sensitive
data.

A FireEye report^[6] last year added to
growing evidence of Chafer’s focus on telecommunications and travel
industries. “Telecommunications firms are attractive targets given
that they store large amounts of personal and customer information,
provide access to critical infrastructure used for communications,
and enable access to a wide range of potential targets across
multiple verticals,” the company said.

APT39 compromises its targets via spear-phishing emails with
malicious attachments and using a variety of backdoor tools to gain
a foothold, elevate their privileges, conduct internal
reconnaissance, and establish persistence in the victim
environment.

What makes the Kuwait attack more elaborate, according to
Bitdefender, is their ability to create a user account on the
victims’ machine and perform malicious actions inside the network,
including network scanning (CrackMapExec), credential harvesting
(Mimikatz), and move laterally inside the networks using a wide
arsenal of tools at their disposal.

Most activity occurs on Friday and Saturday, coinciding with the
weekend in the Middle East, the researchers said.

The attack against a Saudi Arabian entity, on the other hand,
involved the use of social engineering to trick the victim into
running a remote administration tool (RAT), with some of its
components sharing similarities with those used against Kuwait and
Turkey.
^[7]

“While this attack was not as extensive as the one in Kuwait, some
forensic evidence suggests that the same attackers might have
orchestrated it,” the researchers said. “Despite the evidence for
network discovery, we were not able to find any traces for lateral
movement, most probably because threat actors were not able to find
any vulnerable machines.”

The attacks against Kuwait and Saudi Arabia are a reminder that
Iran’s cyber
espionage efforts^[8]
have shown no sign of slowing down. Given the crucial nature of the
industries involved, Chafer’s actions continue the trend of
striking countries that act against its national ambitions.

“While these two are the most recent attack examples happening
in the Middle East, it is important to understand that this type of
attack can happen anywhere in the world, and critical
infrastructures like government and air transportation remain very
sensitive targets,” Bitdefender said.

^[4][5]