Ankura CTIX FLASH Update - September 13, 2024

Malware Activity

New Malware Tied to APT34 Targets the Iraqi Government

Researchers have discovered a new set of malware used in attacks against Iraqi entities allegedly including the Prime Minister's Office and the Ministry of Foreign Affairs. The malware dubbed "Veaty" and "Spearal" have ties to malware families used by APT34, a cyber group affiliated with the Iranian Ministry of Intelligence and Security also known as "OilRig". The malware identified in the campaign is bespoke and along with the techniques deployed, resembles custom backdoors such as "Karkoff" and "Saitama" previously associated with APT34. While the original infection pathway is unknown, the initial files used to kick-off the campaign were likely delivered to victims through social engineering. These initial files use double extensions to appear legitimate. Examples of file names include "Avamer.pdf.exe" and "Protocol.pdf.exe". These files execute PowerShell or Pyinstaller scripts to deploy