{"id":25777,"date":"2021-06-17T15:41:33","date_gmt":"2021-06-17T12:41:33","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=25777"},"modified":"2026-03-27T22:39:31","modified_gmt":"2026-03-27T19:39:31","slug":"a-6-year-cyberespionage-campaign-uncovered-in-the-middle-east","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/a-6-year-cyberespionage-campaign-uncovered-in-the-middle-east\/","title":{"rendered":"A 6-year cyberespionage campaign uncovered in the Middle East"},"content":{"rendered":"\n

Kaspersky has uncovered a long-standing cyberespionage campaign against Persian-speaking individuals in Iran. The group behind the malicious activity\u2014dubbed Ferocious Kitten\u2014has been active since at least 2015 and delivers a custom malware called \u201cMarkiRAT\u201d that steals data and can execute commands on the victim\u2019s machine. The malware also has variants that can hijack the infected user\u2019s Chrome browser and their Telegram app. <\/strong><\/p>\n\n\n\n

In March of this year, a suspicious lure document was uploaded to VirusTotal and brought to the public\u2019s knowledge through a post on Twitter. Upon noticing the Tweet, Kaspersky researchers decided to investigate further. What they found was a 6-year long surveillance campaign against Persian-speaking individuals in Iran. They have since dubbed the actor behind the campaign \u201cFerocious Kitten\u201d. <\/p>\n\n\n\n

Ferocious Kitten, active since at least 2015, targets its victims with decoy documents containing malicious macros. These documents are disguised as images or videos that depict action against the Iranian regime (protests or footage from resistance camps). The initial messages within the decoy documents attempt to convince the target to enable the attached images or videos. If the victim agrees, then malicious executables are dropped to the targeted system, while the decoy content is displayed on the screen. <\/p>\n\n\n\n

I am Hussein Jafari I was a prisoner of the regime during 1363-64.Add my name to the prisoners\u2019 statement of Iraj Mesdaghi about the bloodthirsty mercenary.Please use the nickname Jafar for my own safety and my family. Hussein JafariJuly 1399<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

A decoy message translated from Persian<\/em><\/p>\n\n\n\n

These executables drop the main malicious payload\u2014a custom malware known as \u2018MarkiRAT\u201d. Once downloaded to the infected system, MarkiRAT initiates a keylogger to copy all clipboard content and record all keystrokes. MarkiRAT also provides file download and upload capabilities to the attackers and gives them the ability to execute arbitrary commands on the infected machine. <\/p>\n\n\n\n

Kaspersky researchers were able to uncover several other MarkiRAT variants. One has the ability to intercept the execution of Telegram and launch the malware along with it. It does so by searching the infected device for Telegram\u2019s internal data repository. If present, MarkiRAT copies itself to this repository and then modifies the shortcut that launches Telegram to execute this modified repository with the application itself.  <\/p>\n\n\n\n

Another variant modifies the device\u2019s Chrome browser shortcut in a similar way to the variant targeting Telegram. The result is that, each time the user starts Chrome, the real application is run and the MarkiRAT payload is executed alongside it. Yet another variant is a back doored version of Psiphon, an open source VPN tool often used to bypass internet censorship. Kaspersky has also found evidence that the actors have developed malicious implants targeting Android devices, although researchers were unable to obtain any specific samples for analysis. <\/p>\n\n\n\n

The victims of this campaign appear to be Persian-speaking and located within Iran. The content of the decoy documents suggests the attackers are specifically going after supporters of protest movements within the country. <\/p>\n\n\n\n

\u201cWhile the MarkiRAT malware and accompanying toolset isn\u2019t particularly sophisticated, it is interesting that the group created such specialized variants for Chrome and Telegram. It suggests the threat actors are focused more on adapting their existing toolset to their target environments rather than enriching it with features and capabilities. It\u2019s also quite possible that the group is running several campaigns targeting different platforms,\u201d comments Mark Lechtik, Senior Security Researcher with the Global Research and Analysis Team (GReAT).<\/em><\/p>\n\n\n\n

\u201cWe also found a more recent plain variant using a downloader instead of an embedded payload. This suggests the group is still very much active and may be in the process of modifying their tactics, techniques, and procedures,\u201d adds Paul Rascagneres, Senior Security Researcher with GReAT.<\/em><\/p>\n\n\n\n

\u201cFerocious Kitten\u2019s victimology and TTPs are similar to other actors in the region, namely Domestic Kitten and Rampant Kitten. Together, they form a wider ecosystem of surveillance campaigns in Iran. These types of threat groups don\u2019t appear to be frequently covered, which makes it possible for them to fly under the radar for long periods of time and makes it easier for them to reuse their infrastructure and toolsets,\u201d comments Aseel Kayal, Security Researcher with GReAT.<\/em><\/p>\n\n\n\n

Learn more about Ferocious Kitten on\u00a0Securelist<\/a>.\u00a0<\/p>\n\n\n\n

To protect your organization\u2019s employees from APTs like Ferocious Kitten, Kaspersky experts recommend the following:<\/p>\n\n\n\n