Friday, April 19, 2024

Hacker Group Disguised as Marketing Company to Attack Enterprise Targets

In a recent development, NSFOCUS Security Labs has detected a fresh APT34 phishing attack

During this operation, APT34, believed to originate from Iran and also known as OilRig or Helix Kitten, assumed the identity of a marketing services company named Ganjavi Global Marketing Services (GGMS). 

They particularly targeted enterprises, employing a variant of the SideTwist Trojan to gain sustained control over victim hosts.

A Glimpse into APT34

APT34, an Advanced Persistent Threat (APT) group active since 2014, specializes in cyber espionage and sabotage. 

Operating primarily in the Middle East, they target diverse sectors such as finance, government, energy, chemicals, and telecommunications. 

APT34 possesses advanced attack capabilities, tailoring intrusion methods for different targets and even demonstrating supply chain attack proficiency. 

Following the exposure of their primary attack tools in a 2019 leak, APT34 began developing new tools, including RDAT, SideTwist, and Saitama.

The Deceptive Bait

For this operation, APT34 utilized a decoy file titled “GGMS Overview.doc.” This document introduced a fictitious “Ganjavi Global Marketing Services” company, ostensibly providing global marketing services with a clear focus on enterprises.


Notably, two upload records in the United States suggest APT34’s intention to target U.S. businesses.

Attack Execution

The attack followed a known pattern, albeit with some variations. A malicious macrocode concealed within the decoy file orchestrated the deployment environment. 

This macrocode extracted the Trojan SystemFailureReporter.exe from the document in base64 format, placed it in the %LOCALAPPDATA%\SystemFailureReporter\ directory, and created an update.xml text file in the same directory, serving as the Trojan’s activation switch.

Subsequently, the malicious macro code established a scheduled task called “SystemFailureReporter,” summoning the Trojan every five minutes, ensuring its continuous operation. 

The Trojan, identified as a SideTwist variant, communicated via HTTP with a CnC server at

Anatomy of the Trojan

This variant of the SideTwist Trojan, compiled using GCC, shares similarities with previous iterations but exhibits differences in the compilation. 

Its core functions involve communication with the CnC server, execution of commands, and file uploads. Upon execution, the Trojan checks for the presence of an “update.xml” file, employing anti-sandbox measures. 

It collects victim host information to generate a unique ID and initiates communication with the CnC server.

The CnC communication involves encrypted instructions, decoded using a multi-byte XOR key derived from the string “notmersenne.” These instructions dictate various actions, from running shell commands to downloading/uploading files.

Intriguingly, this APT34 campaign used the CnC IP address Notably, port 443 did not respond, making it challenging to ascertain the nature of the CnC server.

Investigation revealed that this IP address belongs to the United States Department of Defense Network Information Center in Columbus, Ohio.

This choice of IP suggests that APT34 may have used this operation for testing, with the intention of activating a different, concealed CnC address in subsequent attacks.

APT34’s recent attack showcases its consistent methodology while introducing a GCC-based SideTwist Trojan variant and an enigmatic CnC IP address. This specificity implies a testing phase, safeguarding attack resources until the actual CnC address is enabled. 

This strategic approach underscores the adaptability and evasiveness of APT groups.

Keep informed about the latest Cyber Security News by following us on Google NewsLinkedinTwitter, and Facebook.


Latest articles

Alert! Windows LPE Zero-day Exploit Advertised on Hacker Forums

A new zero-day Local Privilege Escalation (LPE) exploit has been put up for sale...

Palo Alto ZeroDay Exploited in The Wild Following PoC Release

Palo Alto Networks has disclosed a critical vulnerability within its PAN-OS operating system, identified...

FIN7 Hackers Attacking IT Employees Of Automotive Industry

IT employees in the automotive industry are often targeted by hackers because they have...

Russian APT44 – The Most Notorious Cyber Sabotage Group Globally

As Russia's invasion of Ukraine enters its third year, the formidable Sandworm (aka FROZENBARENTS,...

SoumniBot Exploiting Android Manifest Flaws to Evade Detection

A new banker, SoumniBot, has recently been identified. It targets Korean users and is...

LeSlipFrancais Data Breach: Customers’ Personal Information Exposed

LeSlipFrancais, the renowned French underwear brand, has confirmed a data breach impacting its customer...

Cisco Hypershield: AI-Powered Hyper-Distributed Security for Data Center

Cisco has unveiled its latest innovation, Cisco Hypershield, marking a milestone in cybersecurity.This groundbreaking...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles