APT34

APT34, also known as OilRig, EUROPIUM, Hazel Sandstorm, and Crambus among other names, is a threat actor believed to be operating on behalf of the Iranian government. Operational since at least 2014, APT34 has been involved in long-term cyber espionage operations primarily focused on reconnaissance efforts to benefit Iranian nation-state interests. The group has targeted a variety of industries, including financial, government, energy, chemical, and telecommunications sectors, with a significant focus on the Middle East. The attribution to Iran is based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests. APT34 leverages multiple malware including POWBAT, POWRUNER, BONDUPDATER, and exploits vulnerabilities such as the Microsoft Office vulnerability CVE-2017-11882 for its campaigns. It shares similarities with other Iranian groups like APT39 and MuddyWater, including overlapping target sectors and malware distribution methods. However, each group exhibits unique characteristics; for instance, APT34's use of the LionTail backdoor is unique to the Scarred Manticore threat actor. In addition, the group has used internet-facing exchange servers as a communication technique, a strategy identified in the Karkoff campaign. The group's activities have intensified over the years. Recently, Symantec’s Threat Hunter Team reported an eight-month-long intrusion by APT34 against an unspecified government in the Middle East, marking an escalation in the cyber war in the region. In this attack, the group reportedly stole files and passwords, installed a PowerShell backdoor to monitor incoming emails from an Exchange Server, and executed commands via emails. This recent activity underscores the persistent and evolving nature of APT34's threats, emphasizing the need for robust cybersecurity measures across targeted sectors.