Hacking group turns Microsoft Office flaw into an exploit in less than a week

APT34 has been especially active since mid-2016, based on publicly available research authored by analysts with FireEye and Kaspersky Lab.

Less than one week after Microsoft publicly acknowledged a remote code execution vulnerability in Microsoft Office, Iranian hackers targeted the weakness via phishing emails sent to various Middle Eastern government agencies last month, according to research produced Thursday by U.S. cybersecurity firm FireEye.

According to FireEye, the targets indicate that the group is likely linked to the Iranian government. There were multiple attempts to breach financial, energy and government enterprises located in geographic rivals of Iran, such as Saudi Arabia and Israel. This particular cyber espionage group, titled APT34 by FireEye, is also known as “OilRig” to other security researchers.

https://twitter.com/FireEye/status/939214584405250050

APT34 has been especially active since mid-2016, based on publicly available research from FireEye and Kaspersky Lab.

“We believe APT34 is involved in a long-term cyber-espionage operation largely focused on reconnaissance efforts to benefit Iranian nation-state interests and has been operational since at least 2014,” a FireEye blog post reads. “We assess that APT34 works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.”

APT34 relies on a mix of open-source, custom and commercial penetration tools to break into targeted organizations, researchers say. The latest phishing campaign used a custom PowerShell backdoor to exploit an outdated, embedded feature Microsoft Office feature known as “Equation Editor.”

During the summer of 2016, APT34 attempted to breach a cohort of different energy organizations all based in the Middle East. During this same time frame, APT34 heavily targeted Saudi Arabian financial institutions. Those operations overlapped with other efforts to spearphish energy, chemical and telecommunications businesses throughout the region.

FireEye’s determination that APT34 is linked to Iranian-based actors was made with “moderate confidence” — a designation defined by analysts in order to qualify the evidence they’ve accumulated. 

Iranian hackers ‘tickle’ targets in US, UAE with custom tool, Microsoft says

Peach Sandstorm is said to have focused on the oil and gas, satellite, government and communications sectors.

Microsoft: Iranian espionage campaign targeted satellite and defense sectors

Iranian hacking group expands focus to US politicians, critical infrastructure, researchers find

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure