Iranian APT Targets Both Windows and Mac Victims
TA453, an Iranian nation-state actor, has been connected to a fresh wave of spear-phishing attacks that infect Windows and macOS operating systems with malicious software.
According to a recent report from Proofpoint, TA453 employed various cloud hosting providers to execute a new infection chain, deploying a newly identified PowerShell backdoor called GorjolEcho.
Furthermore, TA453 expanded its tactics by attempting to launch an Apple-oriented infection chain called NokNok and employed multi-persona impersonation in its relentless pursuit of espionage.
Threat Actor's Past Exploits
This threat group, also known as APT35, Charming Kitten, Mint Sandstorm, and Yellow Garuda, has ties to Iran's Islamic Revolutionary Guard Corps (IRGC) and has been active since at least 2011. Volexity recently revealed their usage of an updated version of the PowerShell implant CharmPower (also known as GhostEcho or POWERSTAR).
In a recent attack observed by an enterprise security firm in May 2023, TA453 sent phishing emails to a nuclear security expert at a U.S.-based think tank focused on foreign affairs. These emails contained a malicious link to a Google Script macro, which redirected the target to a Dropbox URL hosting a RAR archive.
Within this file, an LNK dropper initiated a multi-stage process that ultimately deployed GorjolEcho. This backdoor displayed a decoy PDF document while secretly waiting for next-stage payloads from a remote server. However, upon discovering that the target was using an Apple computer, TA453 modified its approach. They sent a second email with a ZIP archive containing a Mach-O binary disguised as a VPN application. In reality, this binary was an AppleScript that connected to a remote server to download a Bash script-based backdoor known as NokNok.
NokNok, in turn, retrieved up to four modules capable of gathering information on running processes, installed applications, system metadata, and establishing persistence through LaunchAgents.
These modules shared significant functionality with the modules associated with CharmPower, and NokNok exhibited similarities in source code to macOS malware previously attributed to the TA453 group in 2017.
The threat actor also utilized a fraudulent file-sharing website, likely as a means to fingerprint visitors and track successful victims.
