Karkoff

Karkoff is a threat actor identified as part of the APT34 group, known for its malicious cyber activities. It has been linked to several malware families including Karkoff, Saitama, and IIS Group 2, which operate in the same geographical region. The Karkoff malware has been observed communicating through compromised email addresses belonging to Lebanese government entities, mirroring tactics seen in other malware campaigns attributed to APT34. Its operational methodology and the tools used align closely with those of previously identified activity clusters such as Saitama and IISGroup2. Recently discovered malware families, Veaty and Spearal, show striking similarities to Karkoff and Saitama in terms of Tactics, Techniques, and Procedures (TTPs). Both Veaty and Spearal utilize similar techniques and variable names to those previously used by Karkoff malware, including the use of email tunneling. This involves searching for emails with a pre-configured subject, extracting commands to execute from these emails, and then deleting the email. In the case of Karkoff, the pre-configured subject was "Dropbox," while for Veaty it was "PMO." The overlapping methodologies, tools, and target regions between Karkoff, Veaty, and Spearal strongly suggest that these operations are carried out by actors with similar nexuses. Veaty, like Karkoff, has also been observed using compromised mail accounts of government entities, albeit Iraqi ones in this instance. Given these connections, the cybersecurity community has concluded that the Karkoff threat actor is likely involved in the Veaty and Spearal campaigns, further extending the reach and impact of APT34's cyber espionage activities.