The Iran-nexus risk actor often called UNC2428 has been noticed delivering a backdoor often called MURKYTOUR as a part of a job-themed social engineering marketing campaign aimed toward Israel in October 2024.
Google-owned Mandiant described UNC2428 as a risk actor aligned with Iran that engages in cyber espionage-related operations. The intrusion set is alleged to have distributed the malware via a “advanced chain of deception methods.”
“UNC2428’s social engineering marketing campaign focused people whereas posing as a recruitment alternative from Israeli protection contractor, Rafael,” the corporate mentioned in its annual M-Developments report for 2025.
People who expressed curiosity have been redirected to a web site that impersonated Rafael, from the place they have been requested to obtain a instrument to help with making use of for the job.
The instrument (“RafaelConnect.exe”) was an installer dubbed LONEFLEET that, as soon as launched, introduced a graphical consumer interface (GUI) to the sufferer with a purpose to enter their private info and submit their resume.
As soon as submitted, the MURKYTOUR backdoor launched as a background course of via a launcher known as LEAFPILE, granting the attackers persistent entry to the compromised machine.
“Iran-nexus risk actors included graphical consumer interfaces (GUIs) to disguise malware execution and set up as professional functions or software program,” Mandiant mentioned. “The addition of a GUI that presents the consumer with a typical installer and is configured to imitate the shape and performance of the lure used can cut back suspicions from focused people.”
It is value mentioning that the marketing campaign overlaps with exercise that the Israel Nationwide Cyber Directorate attributed to an Iranian risk actor named Black Shadow.
Assessed to be working on behalf of the Iranian Ministry of Intelligence and Safety (MOIS), the hacking group is thought for focusing on a variety of trade verticals in Israel, together with academia, tourism, communications, finance, transportation, healthcare, authorities, and know-how.
Per Mandiant, UNC2428 is without doubt one of the many Iranian risk exercise clusters which have skilled their sights on Israel in 2024. One outstanding group is Cyber Toufan, which focused Israel-based customers with the proprietary POKYBLIGHT wiper.
UNC3313 is one other Iran-nexus risk group that has performed surveillance and strategic information-gathering operations by way of spear-phishing campaigns. UNC3313, first documented by the corporate in February 2022, is believed to be affiliated with MuddyWater.
“The risk actor hosted malware on standard file-sharing companies and embedded hyperlinks inside training- and webinar-themed phishing lures,” Mandiant mentioned. “In a single such marketing campaign, UNC3313 distributed the JELLYBEAN dropper and CANDYBOX backdoor to organizations and people focused by their phishing operations.”
Assaults mounted by UNC3313 have leaned closely on as many as 9 completely different professional distant monitoring and administration (RMM) instruments, a signature tactic of the MuddyWater group, in an try and chase away detection efforts and supply persistent distant entry.
The risk intelligence agency additionally mentioned it noticed in July 2024 a suspected Iran-linked adversary distributing a backdoor codenamed CACTUSPAL by passing it off as an installer for the Palo Alto Networks GlobalProtect distant entry software program.
The set up wizard, upon launch, stealthily deploys the .NET backdoor that, in flip, verifies just one occasion of the method is working earlier than it communicates with an exterior command-and-control (C2) server.
The usage of RMM instruments however, Iranian risk actors like UNC1549 have additionally been noticed taking steps to include cloud infrastructure into their tradecraft in order to make sure that their actions mix in with companies prevalent in enterprise environments.
“Along with methods akin to typosquatting and area reuse, risk actors have discovered that internet hosting C2 nodes or payloads on cloud infrastructure and utilizing cloud-native domains reduces the scrutiny which may be utilized to their operations,” Mandiant mentioned.
Any perception into the Iranian risk panorama is incomplete with out APT42 (aka Charming Kitten), which is thought for its elaborate social engineering and rapport-building efforts to reap credentials and ship bespoke malware for information exfiltration.
The risk actor, per Mandiant, deployed faux login pages masquerading as Google, Microsoft, and Yahoo! as a part of their credential harvesting campaigns, utilizing Google Websites and Dropbox to direct targets to faux Google Meet touchdown pages or login pages.
In all, the cybersecurity firm mentioned it recognized greater than 20 proprietary malware households – together with droppers, downloaders, and backdoors – utilized by Iranian actors in campaigns within the Center East in 2024. Two of the recognized backdoors, DODGYLAFFA and SPAREPRIZE, have been employed by APT34 (aka OilRig) in assaults focusing on Iraqi authorities entities.
“As Iran-nexus risk actors proceed to pursue cyber operations that align with the pursuits of the Iranian regime, they’ll alter their methodologies to adapt to the present safety panorama,” Mandiant mentioned.
