Ankura CTIX FLASH Update - October 20, 2023

Malware Activity

New Report Details Eight-Month Long Campaign Targeting Middle East Government Using Previously Undisclosed Malware

Researchers have published a new report on the recent targeting of an unknown Middle East government in an eight (8) month long campaign by the Iranian Crambus espionage group. Crambus (otherwise known as OilRig, MuddyWater, and APT34) is known for historically targeting various countries, including Saudia Arabia, Israel, the United Arab Emirates, Iraq, Jordan, Albania, the United States, and more, as well as conducting "long-running intrusions for intelligence gathering and spying purposes." This latest campaign ran from February 2023 to September 2023 and involved the deployment of "PowerExchange", a PowerShell backdoor. PowerExchange was used to monitor incoming mail sent from a Microsoft Exchange server to compromised mailboxes to execute commands embedded in malicious emails as well as forward results to the threat group. The