GorjolEcho

GorjolEcho is a sophisticated malware, identified by Proofpoint and attributed with high confidence to the Iranian group TA453, based on code similarities with previously recognized malware such as GhostEcho, CharmPower, and MacDownloader. The malware is delivered via a new infection chain involving various cloud hosting providers, with the aim of deploying GorjolEcho, a PowerShell backdoor that establishes persistence in the victim's system by copying the initial stages of malware in a StartUp entry. Once installed, GorjolEcho displays a decoy PDF to the user while secretly exfiltrating information to the command-and-control (C&C) server. NokNok is seen as an evolution or port of GorjolEcho, designed to serve as an initial foothold for TA453 intrusions. Both GorjolEcho and NokNok are likely to support additional modules that enhance their capabilities. Interestingly, when TA453 encountered a non-Windows environment during an attempted GorjolEcho delivery, it switched to an Apple-specific infection chain using NokNok. This suggests that NokNok is essentially the Mac version of GorjolEcho. The campaign deploying these malwares appears to be highly targeted, with fewer than 10 individuals known to have received phishing emails from TA453 as of the time of reporting. In one instance, upon realizing that GorjolEcho wouldn't execute on macOS, TA453 postponed the attack to later deliver a ported version of the backdoor compatible with Apple hardware. This demonstrates the adaptability and persistence of the threat actors behind these malicious software.