This blog post comes from the UNC1549 MINIBUS Backdoor Technical Analysis report. If you want to download it as a PDFclick here
Summary
In the evolving cyber espionage landscape, state-sponsored threat actors’ activities targeting critical sectors have become increasingly sophisticated and widespread. A notable example of such activities is the campaign orchestrated by the Iranian threat actor known as UNC1549. This group, which has been active since at least June 2022 and continues its operations as of February 2024, has been implicated in espionage efforts primarily targeting the aerospace, aviation, and defense industries across the Middle East, including Israel, the United Arab Emirates (UAE), and potentially extending to Turkey, India, and Albania.
According to a blog post, Mandiant [1], a leading cybersecurity firm, attributes these activities with moderate confidence to UNC1549 and notes that the group overlaps with Tortoiseshell, a threat actor affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC). The current situation seems consistent, given the strategic importance of the targeted sectors and the background of regional tensions such as the Israel-Hamas conflict. In one of its campaigns, UNC1549 exploited themes related to the Israel-Hamas war by disguising itself as the Bring Them Home Now movement advocating the release of Israelis held captive by Hamas.
This detailed technical analysis report aims to dissect the architecture, functionalities, and implications of the MINIBUS Backdoor, shedding light on its role within the broader context of regional cyber espionage activities. The deployment of MINIBUS through deceptive means, such as spear-phishing campaigns and fake job recruitment websites, underscores the threat actor’s emphasis on stealth and evasion. By masquerading as legitimate entities and exploiting trusted cloud infrastructure for command and control (C2) communications, UNC1549 has demonstrated high sophistication and an ability to circumvent traditional security measures. This report will delve into the technical specifics of the MINIBUS malware, including its payload delivery mechanisms, C2 infrastructure, and the unique features that distinguish it from previous tools used by the group.
Scope
| Filename | bringthemhomenow.zip |
| Filetype | ZIP |
| Written Language | N/A |
| MD5 | ef262f571cd429d88f629789616365e4 |
| SHA1 | ff1c547f22708d27688d412006c9c0b357d2eac5 |
| SHA256 | fc95b67fa0664bf2d542f07120a3b51d47ff8eb55a94d00e16827eea26483206 |
| First Seen / Detection Date | 2024-01-03 |
| Initial Infection Vector | Phishing Attachment |
| Filename | secur32.dll |
| Filetype | Win32 DLL |
| Written Language | C/C++ |
| MD5 | c5dc2c75459dc99a42400f6d8b455250 |
| SHA1 | 0ead4133b81cb9f68077df1f3cb9c3ca26a04cc4 |
| SHA256 | 26ca51cb067e1fdf1b8ad54ba49883bc5d1945952239aec0c4840754bff76621 |
| First Seen / Detection Date | 2024-01-04 |
| Initial Infection Vector | ZIP Archive |
| Filename | CoreUIComponent.dll |
| Filetype | Win32 DLL |
| Written Language | C/C++ |
| MD5 | 816af741c3d6be1397d306841d12e206 |
| SHA1 | 4df79bb9c601ef53255ac19be5ca807dc0c5c835 |
| SHA256 | 10e9d1eaf24ad3c63578d89f8b887adb47700aae02da1532c4842428725e77d6 |
| First Seen / Detection Date | 2024-01-04 |
| Initial Infection Vector | ZIP Archive |
Mitigation Strategies
- Implement strict access control policies. Ensure that users have only the access they need to perform their jobs.
- Use email scanning solutions to detect malicious attachments and links within emails.
- Conduct regular training to educate users about the latest phishing tactics and how to recognize suspicious emails and links.
- You can search the FileCoAuth.exe data for the malware we found to use Registry Run Keys to ensure persistence.
- Detecting suspicious traffic can be challenging because UNC1549 often uses legitimate services to hide network traffic and avoid detection in its campaigns. However, you can catch suspicious traffic by monitoring the HTTP header information that we found to be generated in web requests.
- You can check the existence of the %LOCALAPPDATA%\Microsoft\OneDrive\cache\logger directory and the files copied to the directory, if any.
Conclusion
The malware’s ability to masquerade as legitimate applications and utilize cloud infrastructure for command and control (C2) communications complicates detection efforts and necessitates a multi-layered approach to security. The operational context in which MINIBUS has been deployed—targeting critical sectors with significant geopolitical implications—emphasizes the importance of sector-specific threat intelligence and collaboration. Sharing insights and indicators of compromise (IoCs) across organizations and industries can enhance collective defense mechanisms and prevent the successful execution of espionage campaigns. It is also a stark reminder of organizations’ need to foster a culture of security awareness, training employees to recognize and respond to social engineering tactics that are often the first step in such sophisticated attacks.
This blog post comes from the UNC1549 MINIBUS Backdoor Technical Analysis report. If you want to download it as a PDFclick here
References:
[1] Mandiant. Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors.
url: https://www.mandiant.com/resources/blog/suspectediranian-unc1549-targets-israel-middle-east. (Accessed: 28.02.2024).
