Many reports are saying that the Iranian government records and institutes were targeted by the Chinese advance persistent between July and December in the last year of 2022.
Many reports are indicating that Chinese NICKEL, APT15, KeChang, Backdoor Diplomacy, and Vixen Panda are suspected. Their act was like hacking and seems like malware infrastructure associated with the APT group.
In a blog, Palo Alto Networks said about the Chinese activity that they always continue to do such a strategy and its tooling with another nation. Recently it has become clear that cyber-espionage operation was earlier done by China and they did it successfully. The Turian backdoor and new C2 infrastructure show that these actors continue to be successful.
The cyber security firm also stated in their statement that analysis of malicious infrastructure samples and connections shows that Iranian government networks are likely to be compromised.
The report does not stop just by warning the Irish government they also said warned other states too. The reports also indicate similar incidents and techniques can be used by enemies or nations in North and South America, Africa, and the Middle Eastern region.
Agile Taurus Deploys set the New Version Of Turion Malware
In the recent attacks, the Playful Taurus was using a new version of the Turian malware and a new command and control named C2 infrastructure in which they hacked the governmental institution of Iran. This is also confirmed by the research team. These threat actors have obfuscation and a modified network protocol and are used to take out C2 servers. This malware is used to generate and execute reverse shell commands.
In this incident of hacking of four Iranian government networks and organizations, the Foreign Ministry is likely to have been compromised using a new variant of the malware.
Quarion has evolved into Turion but let me tell you that this malware was used in 2013 to threaten USA and Syria diplomatic relations. Turion was first identified by ESET in June 2021 as being used by Agile Taurus.
Many countries have faced the threat
From the year of 2010, several countries have faced the threat and fear of getting hacked. Many telecommunications companies and diplomatic units of government faced the heat. However, earlier attacks focused on hacking web servers and opening web shells and to try and open Internet-exposed apps. Webshell is used for Playful Taurus to open software to take all the information. The dynamic library and hijacking were used to install its backdoor, Turion.
But latterly this technique start to be used in the diplomatic race. And in 2012, Fickle Taurus targeted the Syrian Foreign Ministry and in 2013 the US State Department. In 2021 Microsoft seized 42 domains which were targeting 29 countries.
Comments
Post a Comment