Operation GhostShell Believed to be Linked to Iranian Threat Actor
Researchers have discovered a previously unknown advanced threat actor, probably of Iranian origin, using a previously undocumented RAT targeting largely aerospace and telecommunications organizations. They have named the group MalKamak, and the campaign Operation GhostShell.
Cybereason first detected the threat actor engaged in cyber espionage with the unknown remote access trojan – which it called ShellClient – in July 2021. Initial investigation found the same group targeting aerospace and telecommunications companies in the Middle East. Further investigation found the group also targeting the same sectors in the U.S., Russia, and Europe.
In an analysis report of its investigation, Cybereason has determined that MalKamak has been operating undiscovered since at least 2018. During that period, the ShellClient RAT has evolved from a simple standalone reverse shell to a stealthy modular espionage tool.
The MalKamak group is believed to be of Iranian origin. Although the researchers could find nothing to associate the group with any known APT, they did discover some links to the Iranian Chafer threat actor (also known as APT39, ITG07 and Remix Kitten). They also noticed similarities in coding style and naming conventions with another Iranian group, Agrius, that is primarily known for attacking Israeli organizations and companies.
[ Also Read: What’s in a Threat Group Name? An Inside Look at the Intricacies of Nation-State Attribution ]
Assaf Dahan, head of threat research at Cybereason, suggested that a previous member of Chafer or Agrius could now be involved with MalKamak, or perhaps all three groups have employed the same ‘freelancer’ at some stage. However, he told SecurityWeek that no inferences could be drawn from the absence of China from the list of targets.
“We detected nothing to suggest any Chinese involvement,” he said. Other researchers using different telemetry might subsequently find that Chinese organizations have also been targeted. For now, Cybereason is confident, based primarily on code analysis, that MalKamak is an Iranian group.
The ShellClient RAT is designed for stealth, including the more recent use of Dropbox to host its C2 operations. The use of public cloud services is a growing trend with cybercriminals, allowing C2 communication to blend in with legitimate traffic from such sites. ShellClient uses cold files stored on Dropbox, and replaced as required by the attacker, rather than the more usual interactive C2 sessions.
“To communicate with Dropbox,” say the researchers, “ShellClient uses Dropbox’s API with a unique embedded API key. Before communicating, it encrypts the data using a hardcoded AES encryption key.” This approach is effective and resilient. C2 communication is less likely to be detected by victim systems, while discovery simply requires the Dropbox folders to be rebuilt elsewhere on the service.
The Dropbox storage contains three folders: an agents folder to store uploaded information from victim machines; a commands folder that stores the commands to be fetched, executed, and then deleted by ShellClient; and a results folder that stores the output of the commands executed by ShellClient. The commands folder is checked by ShellClient every two seconds. Commands are downloaded, parsed, and readied for execution – and then deleted from Dropbox.
The ShellClient RAT, now at version 4, is a modular PE using Costura to compress each of the modules using zlib, and containing numerous evasion techniques. For example, the executable stores most of its strings, including configuration strings, as bytes, and then converts them in real-time to Unicode/ASCII to evade antivirus strings detection.
It achieves persistence and privilege escalation to run with SYSTEM privileges on victim machines by creating the nhdService disguised as Network Hosts Detection Service. MalKamak was also observed using an unknown executable named lsa.exe for credential dumping. Although Cybereason was unable to obtain a copy of this executable, it speculates that it may be a variation of SafetyKatz. This is largely based on the name of the dump file created by the tool (debug.bin), which is the same as that created by SafetyKatz, which has previously been tied to Iranian threat actors.
[ Also Read: NSA’s Rob Joyce Explains ‘Sand and Friction’ Security Strategy ]
Important files for exfiltration are first compressed with WinRar before being exported to the Dropbox C2 folders.
The current version of ShellClient has evolved from the first detected version that was compiled on November 06, 2018. This version lacks the features and sophistication found in later versions, and is effectively a rather simple reverse shell. The second version emerged after just three weeks, now including a new service persistence method disguised as a Windows Defender Update service.
By December 2018, version 2.1 adds a variety of new capabilities including FTP and Telnet clients, AES encryption, self-update capabilities and more.
Version 3.1 appeared in January 2019 with mostly minor changes. “The main difference,” say the researchers, “is the removal of the ‘Server’ component from the executable, as well as new code obfuscation and an upgraded commands menu.”
Version 4.0 appeared in August 2021, with multiple improvements and new capabilities including code obfuscation and code protection using Costura; and abandoning the C2 domain and switching to Dropbox for C2. The latest version contains several command functions that seem to do nothing and have no reference in the code. Despite its rapid evolution over the last few years, it seems as if the developers still have future plans for the malware.
Our current assessment, say the Cybereason researchers, is that Operation GhostShell is perpetrated by a newly discovered Iranian activity group called MalKamak using “a sophisticated new Remote Access Trojan (RAT) dubbed ShellClient that was used in highly targeted attacks against a select few Aerospace and Telecommunications companies mainly in the Middle East, with other victims located in the U.S., Russia and Europe.”
Related: Leaked Files from Offensive Cyber Unit Show Iran’s Interest in Targeting ICS
Related: Iran-Linked Hackers Expand Arsenal with New Android Backdoor
Related: DeadRinger: Three-Pronged Attack by Chinese Military Against Major Telcos