Thursday, April 24, 2025
HomeCyber Security NewsHacker Group Disguised as Marketing Company to Attack Enterprise Targets

Hacker Group Disguised as Marketing Company to Attack Enterprise Targets

Published on

SIEM as a Service

Follow Us on Google News

In a recent development, NSFOCUS Security Labs has detected a fresh APT34 phishing attack

During this operation, APT34, believed to originate from Iran and also known as OilRig or Helix Kitten, assumed the identity of a marketing services company named Ganjavi Global Marketing Services (GGMS). 

They particularly targeted enterprises, employing a variant of the SideTwist Trojan to gain sustained control over victim hosts.

- Advertisement - Google News

A Glimpse into APT34

APT34, an Advanced Persistent Threat (APT) group active since 2014, specializes in cyber espionage and sabotage. 

Operating primarily in the Middle East, they target diverse sectors such as finance, government, energy, chemicals, and telecommunications. 

APT34 possesses advanced attack capabilities, tailoring intrusion methods for different targets and even demonstrating supply chain attack proficiency. 

Following the exposure of their primary attack tools in a 2019 leak, APT34 began developing new tools, including RDAT, SideTwist, and Saitama.

The Deceptive Bait

For this operation, APT34 utilized a decoy file titled “GGMS Overview.doc.” This document introduced a fictitious “Ganjavi Global Marketing Services” company, ostensibly providing global marketing services with a clear focus on enterprises.

   

Notably, two upload records in the United States suggest APT34’s intention to target U.S. businesses.

Attack Execution

The attack followed a known pattern, albeit with some variations. A malicious macrocode concealed within the decoy file orchestrated the deployment environment. 

This macrocode extracted the Trojan SystemFailureReporter.exe from the document in base64 format, placed it in the %LOCALAPPDATA%\SystemFailureReporter\ directory, and created an update.xml text file in the same directory, serving as the Trojan’s activation switch.

Subsequently, the malicious macro code established a scheduled task called “SystemFailureReporter,” summoning the Trojan every five minutes, ensuring its continuous operation. 

The Trojan, identified as a SideTwist variant, communicated via HTTP with a CnC server at 11.0.188.38:443.

Anatomy of the Trojan

This variant of the SideTwist Trojan, compiled using GCC, shares similarities with previous iterations but exhibits differences in the compilation. 

Its core functions involve communication with the CnC server, execution of commands, and file uploads. Upon execution, the Trojan checks for the presence of an “update.xml” file, employing anti-sandbox measures. 

It collects victim host information to generate a unique ID and initiates communication with the CnC server.

The CnC communication involves encrypted instructions, decoded using a multi-byte XOR key derived from the string “notmersenne.” These instructions dictate various actions, from running shell commands to downloading/uploading files.

Intriguingly, this APT34 campaign used the CnC IP address 11.0.188.38. Notably, port 443 did not respond, making it challenging to ascertain the nature of the CnC server.

Investigation revealed that this IP address belongs to the United States Department of Defense Network Information Center in Columbus, Ohio.

This choice of IP suggests that APT34 may have used this operation for testing, with the intention of activating a different, concealed CnC address in subsequent attacks.

APT34’s recent attack showcases its consistent methodology while introducing a GCC-based SideTwist Trojan variant and an enigmatic CnC IP address. This specificity implies a testing phase, safeguarding attack resources until the actual CnC address is enabled. 

This strategic approach underscores the adaptability and evasiveness of APT groups.

Keep informed about the latest Cyber Security News by following us on Google NewsLinkedinTwitter, and Facebook.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Verizon DBIR Report: Small Businesses Identified as Key Targets in Ransomware Attacks

Verizon Business's 2025 Data Breach Investigations Report (DBIR), released on April 24, 2025, paints...

Lazarus APT Targets Organizations by Exploiting One-Day Vulnerabilities

A recent cyber espionage campaign by the notorious Lazarus Advanced Persistent Threat (APT) group,...

ToyMaker Hackers Compromise Numerous Hosts via SSH and File Transfer Tools

In a alarming cybersecurity breach uncovered by Cisco Talos in 2023, a critical infrastructure...

Threat Actors Exploiting Unsecured Kubernetes Clusters for Crypto Mining

In a startling revelation from Microsoft Threat Intelligence, threat actors are increasingly targeting unsecured...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Verizon DBIR Report: Small Businesses Identified as Key Targets in Ransomware Attacks

Verizon Business's 2025 Data Breach Investigations Report (DBIR), released on April 24, 2025, paints...

Lazarus APT Targets Organizations by Exploiting One-Day Vulnerabilities

A recent cyber espionage campaign by the notorious Lazarus Advanced Persistent Threat (APT) group,...

ToyMaker Hackers Compromise Numerous Hosts via SSH and File Transfer Tools

In a alarming cybersecurity breach uncovered by Cisco Talos in 2023, a critical infrastructure...