Ballistic Bobcat

Ballistic Bobcat, also known as APT35, APT42, Charming Kitten, TA453, and Phosphorus, is a threat actor group believed to be aligned with Iran. The group has been active for several years, developing and deploying a series of backdoor exploits known as Sponsor (versions v1 through v4). Ballistic Bobcat's activities have notably evolved over time, shifting towards more noticeable operations aimed at Israel. This shift was concurrent with a downturn in the activities of another threat actor, OilRig, suggesting a strategic realignment. In a recent campaign, Ballistic Bobcat initiated a global cyber espionage operation targeting 14 countries, with the majority of the victims being located in Israel. The group's modus operandi involves exploiting vulnerabilities, often opportunistically, in Microsoft Exchange as part of their "Sponsoring Access" campaign. They've developed a unique approach to evade scans by employing innocuous configuration files and using a modular method. Open-source tools such as host2ip.exe, RevSocks, Mimikatz, Armadillo PE packer, GO Simple Tunnel (GOST), Chisel, csrss_protected.exe, Plink (PuTTY Link), WebBrowserPassView.exe, and sqlextractor.exe have been used on compromised systems. In one notable instance, Ballistic Bobcat hit an Israeli insurance marketplace in August 2021 by exploiting tools reported by the Cybersecurity and Infrastructure Security Agency (CISA). Recently, in May 2022, security experts uncovered a new backdoor deployed by the Ballistic Bobcat APT group from a sample on an Israeli victim’s system. This new campaign, named Sponsor Malware, shows a clear pattern in tool development, indicating an overlap between Ballistic Bobcat and Sponsor backdoor campaigns. The group has also introduced a new server, piggybacking on PowerLess C&C, and using multiple IPs for tools which are now inactive. The threat posed by Ballistic Bobcat continues to evolve, highlighting the need for robust cybersecurity measures and vigilance in tracking the activities of such threat actors.