Hackers believed to be operating on behalf of the Iranian government have targeted Iraqi government networks, based on an analysis of malware and infrastructure conducted by cybersecurity firm Check Point.
There are very few reports describing cyberattacks launched by Iran against Iraqi targets.
Iran and Iraq share a border of nearly 1,000 miles, and after a relatively long period of border disputes, relations between the two countries have improved in the past two decades. Iran has become Iraq’s largest trading partner, and they are very close allies against the Islamic State.
However, according to Check Point, Iran has been conducting cyberespionage operations aimed at various Iraqi entities, including the country’s government.
The security firm has been closely monitoring a campaign for the past few months. The attacks involve custom malware and infrastructure set up for specific targets, with links found to known threat actors previously tied to Iran’s Ministry of Intelligence and Security (MOIS).
The malware used in the attacks aimed at Iraqi organizations is tracked by Check Point as Veaty and Spearal, described as backdoors that enable their operators to execute commands, and download and upload files to and from the compromised system.
Veaty and Spearal bear similarities to malware known to have been used by Iranian state-sponsored threat actor APT34 (aka Cobalt Gypsy, OilRig, and Helix Kitten).
According to the security firm, the malware used in the attacks on Iraq leverages a passive IIS backdoor, DNS tunneling, and command and control (C&C) communications through compromised email accounts belonging to the targeted organization.
The use of these email accounts suggests that the attackers have successfully infiltrated the target’s network, Check Point noted.
The malware is likely being distributed through some type of social engineering technique whose goal is to get the target to open a malicious file disguised as a harmless document.
The malware was uploaded to VirusTotal from Iraq between March and May, which indicates that Iraq is aware of the attacks.
Related: Iranian Hackers Use New Tickler Malware for Intelligence Gathering on Critical Infrastructure
Related: US Sees Iranian Hackers Working Closely With Ransomware Groups
Related: Google Disrupts Iranian Hacking Activity Targeting US Presidential Election
Related: Iranian Hackers Lurked for 8 Months in Government Network
