Loading story…
The Iran-linked Chafer threat group broadened its surveillance-focused intrusion campaign by compromising nine additional organizations across the Middle East and beyond, including targets in telecommunications, airlines, aircraft services, IT services, payroll, engineering, and document management. Symantec reported that the group breached a major regional telecom services provider and also attempted to penetrate a large international travel reservations company, indicating a wider operational scope and growing ambition beyond its earlier victim set.
Chafer used spear-phishing Excel documents to launch infections that dropped VBS and PowerShell payloads, then deployed information-stealing and screen-capture malware before moving laterally inside victim networks. The operators also expanded their toolkit with utilities and infrastructure including Remcom, NSSM, UltraVNC, NBTScan, GNU HTTPTunnel, EternalBlue-enabled SMB tooling, and the command-and-control domain win7-updates[.]com; researchers also noted overlaps with Crambus/Oilrig in infrastructure and infection chains, though they said the evidence was insufficient to conclude the groups were the same.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
In its 2017 campaigns, Chafer adopted tools including Remcom, NSSM, EternalBlue-enabled SMB tooling, UltraVNC, NBTScan, and GNU HTTPTunnel to move laterally, persist, and remotely access victim systems.
In 2017, Chafer added a new infection method using malicious Excel spreadsheets that downloaded a VBS file to execute a PowerShell script before later deploying a dropper and surveillance tools.
Chafer attempted to compromise a large international travel reservations firm, but Symantec found no indication that the effort succeeded.
Chafer successfully infiltrated an African airline that was a customer of a large international travel reservations firm.
During its 2017 activity, Chafer compromised a major Middle Eastern telecoms services provider, apparently to facilitate surveillance of telecom end-user customers.
Throughout 2017, Chafer attacked nine new organizations across telecoms, airlines, aircraft services, IT services, payroll, engineering, and document management in the Middle East and beyond.
Symantec reported that it first exposed Chafer’s activities in December 2015.
Symantec said the Iran-based Chafer group has been active since at least July 2014.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
symantec-blogs.broadcom.com
Open sourcesymantec.com
Open sourcesymantec.com
Open sourcesymantec.com
Open sourcesymantec.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An Iran-linked espionage cluster tracked as **Greenbug** and **OilRig/APT34** targeted telecommunications providers in South Asia while relying on a broader toolkit built for stealthy persistence, credential theft, and covert command-and-control. Symantec reported intrusions spanning at least April 2019 to April 2020 in which attackers used email lures and malicious `CHM` and `HTA` files for initial access, then moved through victim networks with tools including **Covenant**, **Cobalt Strike**, **Mimikatz**, **Plink**, **Bitvise**, **PowerShell**, **BITSAdmin**, and webshells. In one intrusion that lasted about six months, the operators focused on harvesting credentials, maintaining privileged access, tunneling into internal systems, and testing access to database servers inside telecom environments. Multiple reports tie that activity to established OilRig tradecraft, including Exchange-focused `.NET` webshells planted under `/owa/auth/`, scheduled-task persistence, and extensive use of **DNS tunneling** to hide C2 and exfiltration traffic. Unit 42 and IronNet described tools such as **ISMAgent**, **Helminth**, **ALMACommunicator**, **BONDUPDATER**, **QUADAGENT**, and **PoisonFrog**, which encoded tasking and stolen data into crafted DNS subdomains and used `A`, `AAAA`, or `TXT` responses to pass commands. NSFOCUS said a leaked APT34 toolkit exposed PowerShell RATs, webshells, the **Webmask** DNS/HTTP hijacking tool, and more than 12,000 weak passwords, while earlier ClearSky reporting showed Greenbug delivering **ISMAgent** through an Office exploit for `CVE-2017-0199` and `certutil.exe`-decoded payloads, underscoring a long-running pattern of low-profile access operations and intelligence collection.
Aug 15, 2026
Kaspersky reported that several interconnected pro-Ukrainian hacktivist groups, including **4BID**, **Hacker kiт**, **C.A.S**, and **Goffee**, expanded attacks beyond Russia and Belarus to targets in **Kazakhstan, the UAE, Syria, and Egypt**. Victims included government entities, healthcare organizations, and the aviation sector. Researchers said the intrusions commonly began with exploitation of Microsoft Exchange **ProxyShell** vulnerabilities, followed by deployment of the `fd.aspx` ASP.NET web shell, execution of PowerShell or `cmd.exe`, reconnaissance, and installation of remote-management tools such as AnyDesk, Dev Tunnels, Panorama9, Tactical RMM, and Nezha Monitoring. The campaigns used a broad post-compromise toolkit that mixed public C2 frameworks and custom malware, including **Sliver**, **Havoc**, **Mythic Apollo**, **AdaptixC2**, **BlackSalt** backdoor, **Warp RAT**, **BlackReaperRAT**, **ClearWater** ransomware, and an updated **Blackout Locker**. Investigators also observed BYOVD-based EDR killers, including modified EDRKiller variants and GhostDriver, along with signs that some delivery scripts may have been AI-generated. ClearWater was seen encrypting files with **ChaCha20** and **RSA-2048**, dropping ransom notes, changing wallpapers, and deleting recovery artifacts, while Blackout Locker added a persistent screen-locking feature, reinforcing researchers' assessment that the actors are shifting from politically branded hacktivism toward financially motivated operations.
Jun 29, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026