Ironwind

IronWind is a threat actor that has been active since at least October 2023, known for its use of sophisticated malware and encryption techniques to carry out cyber attacks. This group uses a unique variant of the IronWind loader as an infection vector, which enables communication with command and control (C2) servers and executes malicious code hidden within HTML elements. Notably, the encryption function in the IronWind sample bears striking similarities to MicrosoftEdge.exe wiper, suggesting an overlap in the codebase. The IronWind variant uses the key 'msasn1.dll', while the wiper uses the key 'Saturday, October 07, 2023, 6:29:00 AM'. A newer variant of the IronWind loader was found to use 'propsys.dll', indicating continuous evolution and adaptation by the threat actor. Since October 2023, multiple cases have observed the use of the IronWind loader in cyber attacks, further reinforcing its prevalence. IronWind's activities were first publicly disclosed in November 2023 as part of a TA402 operation, a pro-Palestinian advanced persistent threat (APT) group. The campaign utilized custom loaders like IronWind to target Middle East-based government entities. The group initially used 'tabcal.exe' to sideload its initial access downloader IronWind but later switched to other methods, showing their adaptive tactics to evade detection and maintain their operations.