APT34 hackers Using New Custom Malware to Attack Finance & Telecomm Industries

A sophisticated cyber espionage campaign attributed to Iranian state-sponsored group APT34 (OilRig) has targeted Iraqi governmental entities and critical infrastructure sectors since late 2024, leveraging new malware variants designed to evade conventional security measures.

The group, active since 2012, has expanded its operational focus to include financial institutions and telecommunications providers across the Middle East.

The malware—distributed through spear-phishing emails posing as official Iraqi government documents—utilizes multi-stage payload delivery and environmental awareness checks to avoid sandbox detection.

Attack chains begin with executables masquerading as PDF files (Ravateb.pdf.exe) that deploy backdoors capable of both HTTP and compromised email account-based command-and-control (C2) communication.

ThreatBook analysts identified over a dozen compromised Iraqi government email addresses being exploited for lateral movement, including fadi.Al-shemary@pmo.gov.iq and investunit@pmo.gov.iq.

Technical Analysis of Persistence Mechanisms and Detection Evasion

The malware employs layered obfuscation techniques, beginning with position-based string mutation prior to Base64 decoding.

The initial payload removes specific character indices (11th, 8th, 5th, 2nd, and 0th positions) before applying XOR decryption with the hardcoded key “felkkf jerf43klt lkg ert#$ T#$t”.

This anti-analysis approach generates unique string patterns for each execution, defeating static signature detection.

def decode_FromC2(input_str):
    if len(input_str) > 12:
        input_str = input_str[:12] + input_str[13:]
    if len(input_str) > 7:
        input_str = input_str[:7] + input_str[8:]
    if len(input_str) > 5:
        input_str = input_str[:5] + input_str[6:]
    if len(input_str) > 2:
        input_str = input_str[:2] + input_str[3:]
    if len(input_str) > 0:
        input_str = input_str[1:]
    return xor_base64(input_str)

Post-infection, the malware establishes persistence through a Windows service named “MonitorUpdate” configured with randomized execution intervals between 60-120 minutes.

The service creation process modifies file timestamps to match legitimate system binaries and implements multiple environment checks:-

1. Verifies at least four non-shortcut files exist on the desktop
2. Confirms system uptime exceeds three months
3. Checks motherboard information for virtualization artifacts

Successful deployment leads to C2 communication with European servers on ports 10443/TCP and 8989/TCP, using HTTP endpoints like /resource and /document for data exfiltration.

The malware’s configuration file (windowsObject.exe.config) contains modular settings for adaptable operations:-

<appSettings>
    <add key="P" value="10443" />
    <add key="lower_sec" value="60" />
    <add key="upper_sec" value="120" />
    <add key="I" value="UXClxFCHX11IJEllWXFQHCg==" />
</appSettings>

ThreatBook’s analysis reveals APT34 maintains operational flexibility through a distributed C2 infrastructure leveraging European hosting providers, with identified nodes including 89.46.233.239 (Norway) and 151.236.17.231 (Germany).

The group employs domain generation algorithms combining regional keywords like “iqwebservice” and “asiacall” to create plausible-looking domains.

This campaign demonstrates APT34’s continued evolution in attacking financial networks, combining traditional credential harvesting with novel cryptographic evasion techniques.

ThreatBook’s Threat Detection Platform (TDP) and OneDNS services currently provide coverage for associated indicators of compromise, though the malware’s adaptive communication protocols necessitate behavioral analysis defenses.

Are You from SOC/DFIR Team? - Try Free Malware Research with ANY.RUN - Start Now