APT34

APT34, a threat actor suspected to be linked to Iran, has been operational since at least 2014 and is involved in long-term cyber espionage operations largely focused on reconnaissance efforts. The group targets a variety of sectors including financial, government, energy, chemical, and telecommunications, with its operations primarily concentrated in the Middle East. APT34 uses malware families such as POWBAT, POWRUNER, and BONDUPDATER, which are associated with previous APT34 campaigns and have ties to other malware families like Karkoff, Saitama, and IIS Group 2. In its latest campaign, it leveraged a Microsoft Office vulnerability (CVE-2017-11882) to deploy these malwares. The group's tactics, techniques, and procedures (TTPs) closely resemble those used by the Karkoff and Saitama malware families, suggesting a common origin. Notably, APT34's sophisticated technique for abusing Windows password filters to drop malicious DLLs into the system directory, and exploiting CVE-2024-30088 to gain higher privileges on infected machines, demonstrates their advanced capabilities. They also use a stealthy exfiltration channel that allows them to steal data from sensitive networks, often evading detection. APT34 has been known to leverage access within one organization to carry out follow-on attacks against others tied to it. Recent activity from APT34 includes the deployment of Web shells to vulnerable Web servers, and the use of ngrok for command-and-control (C2), which tunnels through firewalls and other network security barriers, facilitating access to a network's Domain Controller. Trend Micro has reported a "notable rise" in APT34's espionage and theft of sensitive information from government agencies, particularly within the UAE. Given the geopolitical tensions and APT34's increasing activities, organizations are advised to remain vigilant and adopt robust cybersecurity measures.