Saitama

Saitama is identified as a threat actor, a human entity responsible for executing actions with malicious intent. It's associated with the execution of cyber-attacks using sophisticated malware such as Saitama and Spearal, which employ base32-encoded commands passed through DNS tunneling. The techniques used by these malwares are similar to those used by other malware families, Karkoff and IIS Group 2, all of which have ties to APT34, a known advanced persistent threat (APT) group. Furthermore, there is a notable similarity in domain name conventions between Saitama malware and asiacall.net, a C2 domain associated with this campaign. The discovery of the Veaty and Spearal malware families, along with the presence of a passive IIS backdoor, aligns this campaign with previously identified activity clusters like Karkoff, Saitama, and IISGroup2. This overlap in malware families and methodologies suggests that the same threat actor might be behind these operations. The geographical targeting also indicates a common nexus among the actors carrying out these attacks, further strengthening the association with APT34. In a specific instance, Saitama was used in an attack targeting Jordanian government entities. Masquerading as the Government of Jordan, APT34 sent an email via Microsoft Outlook containing a malicious Excel document that housed the Saitama backdoor to other officials within the Jordanian government. This incident underscores the threat posed by Saitama and its associated entities, highlighting the need for robust cybersecurity measures to counter such threats.