Full Report
ESET researchers analyzed a cyberespionage campaign conducted by BladedFeline, an Iran-aligned APT group with likely ties to OilRig
Analysis Summary
# Threat Actor: BladedFeline
## Attribution & Identity
BladedFeline is an Iran-aligned cyberespionage group, active since at least 2017.
**Attribution Assessment:** Assessed with medium confidence to be a subgroup of the Iran-aligned APT group OilRig (also tracked as Lyceum). Initial implants are traceable back to OilRig.
## Activity Summary
Active since at least 2017, when it compromised officials within the Kurdistan Regional Government (KRG).
* **2023:** Compromised Kurdish diplomatic officials using the Shahmaran backdoor.
* **2024:** Discovered maintaining access in systems used by Kurdish and Iraqi government officials, and exploiting a regional telecommunications provider in Uzbekistan.
* **Objective:** Develops and utilizes malware to maintain and expand persistent access within targeted organizations in Iraq and the KRG.
## Tactics, Techniques & Procedures
- **Defense Evasion:** Routinely timestomps compilation timestamps of developed malware ($\text{T1070.006}$). Uses legitimate accounts to exfiltrate data ($\text{T1078}$). Whisper backdoor uses base64 encoding ($\text{T1140}$). Post-installation, Whisper's Python dropper deletes itself ($\text{T1070.004}$).
- **Credential Access:** Dumps LSASS memory to steal credentials ($\text{T1003.001}$).
- **Command and Control:**
- Whisper uses AES encryption over an established channel ($\text{T1573.001}$), communicating via email attachments ($\text{T1048.001}$).
- PrimeCache uses standard web protocols ($\text{T1071.001}$) with a combination of RSA and AES-CBC for encryption ($\text{T1573.002}$).
- PrimeCache can download additional files from C2 ($\text{T1105}$).
- PrimeCache uses standard encoding for C2 communication ($\text{T1132.001}$).
- **Exfiltration:** Whisper uses AES encryption and emails to exfiltrate data ($\text{T1048.001}$). PrimeCache exfiltrates data over the C2 channel ($\text{T1041}$).
## Targeting
- **Sectors:** Government (Kurdish Regional Government, Government of Iraq), Telecommunications.
- **Geography:** Iraq, Kurdistan Region (KRG), Uzbekistan.
- **Victims:** Officials within the Kurdistan Regional Government (KRG), high-ranking officials within the government of Iraq (GOI), a regional telecommunications provider in Uzbekistan.
## Tools & Infrastructure
- **Malware Families:**
- **Shahmaran:** A 64-bit backdoor executable, notably simple and lacking compression/encryption for initial network communications.
- **Whisper:** Backdoor that communicates by logging into a compromised Microsoft Exchange webmail account and sending data via email attachments; uses AES encryption.
- **PrimeCache:** A malicious IIS module serving as a backdoor, bearing similarities to the RDAT backdoor used by OilRig.
- **Laret & Pinar:** Two reverse tunnels utilized.
- **Flog:** A webshell.
- **Hawking Listener:** An early-stage implant that listens on a specified port.
- **Infrastructure:** Communication via C2 servers utilizing email inboxes (Exchange servers) for Whisper. No specific C2 infrastructure listed (URLs/IPs unfanged).
## Implications
BladedFeline demonstrates persistent, long-term cyberespionage activity aligned with Iranian state interests, specifically targeting critical governmental and regional infrastructure in the Middle East (Iraq/KRG). The established link to OilRig suggests group maturation and potentially shared resources, utilizing advanced custom malware that leverages legitimate services (like Exchange mailboxes) for covert C2 operations, specifically targeting high-value diplomatic and government entities.
## Mitigations
- Monitor and secure Microsoft Exchange servers, particularly webmail account activity, for suspicious communications or email attachments originating from automated processes.
- Implement robust endpoint detection and response capable of detecting file deletion ($\text{T1070.004}$) and timestamp manipulation ($\text{T1070.006}$) on newly deployed binaries.
- Review credential security, focusing on monitoring for LSASS memory access or dumping ($\text{T1003.001}$).
- Monitor for custom reverse tunnel activity ($\text{Laret, Pinar}$) and the deployment of native IIS malware like PrimeCache.
- Employ network monitoring to detect unusual outbound traffic patterns, especially encrypted communications that may be layered over standard web protocols or email channels.