Input: A personal note from Cylance, CEO Stuart McClure On February 24, 1989, United Flight 811 left Honolulu, Hawaii, on its way to Auckland, New Zealand, with 364 souls on board.


Input: Somewhere between 23,000 and 24,000 feet an enormous explosion ejected nine passengers into the dark void over the Pacific Ocean.


Input: This aviation disaster was later determined to have been caused by a simple design flaw combined with the lack of corrective action.


Input: Boeing and the FAA had known about this problem for over one year prior to the accident.


Input: The result: nine people lost their lives.


Input: The other 337 passengers plus 18 crew members who survived, live with the memory every day; all of it due to a highly preventable design flaw.


Input: As a 19-year-old young adult, I was grateful to have survived but I had no idea how that single event would impact my future in such a profound way.


Input: Much of my passion for cybersecurity can be directly attributed to that fateful day.


Input: The United Flight 811 accident proves just how important it is to detect flaws before tragedy strikes.


Input: Preventable disasters like this are what motivates the Cylance team to create a safer world.


Input: We do everything we can to uncover the flaws in technologies before they damage the physical or cyber world.


Input: Our mission is simple: to protect the world.


Input: This report is an attempt to deliver on that mission.


Input: After tracking hackers both personally and professionally for more than 26 years, there is no doubt in my mind that the release of the information contained in the Operation Cleaver report is vital to the security of the world's critical infrastructure.


Input: The focus of the Operation Cleaver report is on one particular Iranian team we've dubbed Tarh Andishan, the infrastructure they utilize, as well as their tactics, techniques and procedures.


Input: Roughly translated,'' Tarh Andishan'' means'' thinkers'' or'' innovators''.


Input: This team displays an evolved skillset and uses a complex infrastructure to perform attacks of espionage, theft, and the potential destruction of control systems and networks.


Input: While our investigation is ongoing, and we presently have limited visibility inside many of the compromised networks, Cylance observed Tarh Andishan actively targeting, attacking, and compromising more than 50 victims since at least 2012.


Input: Cylance is committed to responsible disclosure and has refrained from exaggeration and embellishment in this report, limiting our content to only that which can be definitively confirmed.


Input: However, we have speculated on the possible motivations behind these attacks, given our deep knowledge and understanding of the cyber landscape.


Input: We have made every effort to notify all affected entities prior to publishing this report.


Input: Additionally, all personally identifiable information about the members of Operation Cleaver has been withheld.


Input: We don't care who the adversary is, where they work or reside, who they're dating or what party photos they upload to Facebook–all we care about is preventing campaigns like Operation Cleaver from negatively affecting the real world.


Input: This report is for the world's cyber defenders–never give up! Since at least 2012, Iranian actors have directly attacked, established persistence in, and extracted highly sensitive materials from the networks of government agencies and major critical infrastructure companies in the following countries: Canada, China, England, France, Germany, India, Israel, Kuwait, Mexico, Pakistan, Qatar, Saudi Arabia, South Korea, Turkey, United Arab Emirates, and the United States.

Iranian actors

persistence

highly sensitive materials

the networks of government agencies and major critical infrastructure companies in the following countries: Canada, China, England, France, Germany, India, Israel, Kuwait, Mexico, Pakistan, Qatar, Saudi Arabia, South Korea, Turkey, United Arab Emirates, and the United States

established

extracted

in

from


Input: Iran is the new China.


Input: Operation Cleaver has, over the past several years, conducted a significant global surveillance and infiltration campaign.

Operation Cleaver

a significant global surveillance and infiltration campaign

conducted


Input: To date it has successfully evaded detection by existing security technologies.

it

detection by existing security technologies

evaded


Input: The group is believed to work from Tehran, Iran, although auxiliary team members were identified in other locations including the Netherlands, Canada, and the UK.


Input: The group successfully leveraged both publicly available, and customized tools to attack and compromise targets around the globe.


Input: The targets include military, oil and gas, energy and utilities, transportation, airlines, airports, hospitals, telecommunications, technology, education, aerospace, Defense Industrial Base (DIB), chemical companies, and governments.


Input: During intense intelligence gathering over the last 24 months, we observed the technical capabilities of the Operation Cleaver team rapidly evolve faster than any previously observed Iranian effort.


Input: As Iran's cyber warfare capabilities continue to morph, the probability of an attack that could impact the physical world at a national or global level is rapidly increasing.


Input: Their capabilities have advanced beyond simple website defacements, Distributed Denial of Service (DDoS) attacks, and Hacking Exposed style techniques.


Input: With minimal separation between private companies and the Iranian government, their modus operandi seems clear: blur the line between legitimate engineering companies and state- sponsored cyber hacking teams to establish a foothold in the world's critical infrastructure.


Input: Iran's rising expertise, along with their choice of victims, has compelled us to release this report sooner than we would have liked in order to expose Operation Cleaver to the world.


Input: The evidence and indicators of compromise we provide in this report will allow potentially unaware victims to detect and eliminate Cleaver's incursions into their networks.


Input: Iran has been severely impacted by debilitating and extremely advanced malware campaigns since at least 2009.


Input: Famous examples of these efforts include industrial sabotage via Stuxnet (2009-2010), and espionage with Duqu (2009-2011) as well as Flame (2012).

Famous examples of these efforts

industrial sabotage

Stuxnet (2009-2010)

espionage

Duqu (2009-2011) as well as Flame (2012)

include

via

with


Input: These campaigns have targeted Iran's nuclear program, and oil and gas operations.


Input: Stuxnet was an eye-opening event for Iranian authorities, exposing them to the world of physical destruction via electronic means.

Stuxnet

them

the world of physical destruction via electronic means

exposing

to


Input: Hacking campaigns sourced out of Iran are nothing new.


Input: Since the early 2000's, the information security industry as a whole has tracked teams like the Iranian Cyber Army, which mainly focuses on patriotic hacking (website defacements).


Input: After the release of Stuxnet, Iran's motivations appear to have shifted.


Input: Retaliation for Stuxnet began almost immediately in 2011 with campaigns like the certificate compromises of Comodo and DigiNotar.


Input: These attacks served as a warning, showcasing the rapid evolution of Iran's hacking skills.


Input: A major retaliation came in the form of 2012's Shamoon campaign, which impacted RasGas and Saudi Aramco.


Input: It's estimated that Shamoon impacted over 30,000 computer endpoints and cost the affected companies tens-of-thousands of hours recovering from the attacks.


Input: The direct financial impact from this retaliation and amount of downtime experienced were staggering.


Input: Shamoon was truly a watershed event for security defenders.


Input: It was the first glimpse into the real capabillity and intention of Iranian cyber operations.


Input: We see the same motivation and intent here in Operation Cleaver: establishing a beachhead for cyber sabotage.


Input: We saw further Iranian backlash in late 2012 and early 2013 in the form of Operation Ababil's Distributed Denial of Service (DDoS) attacks against US banks.


Input: These attacks were debilitating and impacted the availability of online banking services.

These attacks

the availability of online banking services

impacted


Input: Yet more backlash was witnessed with FireEye's exposure of Operation Saffron Rose, an espionage campaign executed by the Ajax Security Team in 2014.


Input: In May 2014, evidence emerged of a highly targeted waterhole attack that leveraged social media, dubbed Operation Newscaster, which was uncovered by iSight Partners.

a highly targeted waterhole attack

social media

leveraged


Input: In June 2013, Israeli Prime Minister Benjamin Netanyahu accused Iran of carrying out'' non-stop'' attacks on'' [Israel's] vital national systems'' including'' water, power and banking''.


Input: The following September of 2013, the Wall Street Journal accused Iran of hacking into unclassified U.S. Navy computers in San Diego's NMCI (Navy Marine Corp Intranet) ,5 which we can confirm was part of Operation Cleaver.


Input: While previously reported operations attributed to Iran have largely focused on Defense Industrial Base (DIB) companies, the United States Federal Government, or targets in Middle Eastern countries, Operation Cleaver has instead focused on a wide array of targets, including energy producers and utilities, commercial airlines and airports, military intelligence, aerospace, hospitals, and even universities–with only ten of the targets based in the United States.


Input: Such broad targeting demonstrates to the world that Iran is no longer content to retaliate against the US and Israel alone.


Input: They have bigger intentions: to position themselves to impact critical infrastructure globally.


Input: The string cleaver is found several times in a variety of custom software used in Operation Cleaver, including: We believe our visibility into this campaign represents only a fraction of Operation Cleaver's full scope.


Input: We believe that if the operation is left to continue unabated, it is only a matter of time before the world's physical safety is impacted by it.


Input: While the disclosure of this information will be a detriment to our ability to track the activity of this group, it will allow the security industry as a whole to defend against this threat.


Input: As such, we are exposing this cyber campaign early in an attempt to minimize additional real-world impact and prevent further victimization.


Input: • Persian hacker names are used throughout the campaign including: Salman Ghazikhani, Bahman Mohebbi, Kaj, Parviz, Alireza, and numerous others.


Input: • Numerous domains used in the campaign were registered in Iran.


Input: • Infrastructure leveraged in the attack was registered in Iran to the corporate entity Tarh Andishan, which translates to'' invention'' or'' innovation'' in Farsi.


Input: • Source netblocks and ASNs are registered to Iran.


Input: • Hacker tools warn when their external IP address traces back to Iran.


Input: • The infrastructure is hosted through Netafraz.com, an Iranian provider out of Isfahan, Iran.


Input: • The infrastructure utilized in the campaign is too significant to be a lone individual or a small group.


Input: We believe this work was sponsored by Iran.


Input: • US Military targets including NMCI in October 2013.


Input: Confirmed targeting of global government entities.


Input: • Networks and systems targeted in critical industries like energy and utilities, oil and gas, and chemical companies.


Input: • Assets (both cyber and physical) and logistics information were compromised at major airline operators, airports, and transportation companies.

Assets (both cyber and physical) and logistics information

major airline operators, airports, and transportation companies

were compromised

at


Input: • Various global telecommunications, technology, healthcare, aerospace, and defense companies were breached as part of the operation.


Input: • Confidential critical infrastructure documents were harvested from major educational institutions around the world.

Confidential critical infrastructure documents

major educational institutions around the world

were harvested

from


Input: • Initial compromise techniques include SQL injection, web attacks, and creative deception- based attacks–all of which have been implemented in the past by Chinese and Russian hacking teams.

Initial compromise techniques

SQL injection, web attacks, and creative deception- based attacks

include


Input: • Pivoting and exploitation techniques leveraged existing public exploits for MS08-067 and Windows privilege escalations, and were coupled with automated, worm-like propagation mechanisms.

Pivoting and exploitation techniques

existing public exploits for MS08-067 and Windows privilege escalations

automated, worm-like propagation mechanisms

leveraged

were coupled

with


Input: • Customized private tools with functions that include ARP poisoning, encryption, credential dumping, ASP.NET shells, web backdoors, process enumeration, WMI querying, HTTP and SMB communications, network interface sniffing, and keystroke logging.

Customized private tools with functions

ARP poisoning

encryption

credential dumping

ASP.NET shells

web backdoors

process enumeration

WMI querying

HTTP and SMB communications

network interface sniffing

keystroke logging

include


Input: • The ability to build customized tools to compromise any target they choose.


Input: • Private signing certificates of one victim were captured allowing the Operation Cleaver team to compromise the entirety of their organization.

Private signing certificates of one victim

the Operation Cleaver team

the entirety of their organization

were captured

compromise


Input: • Over the past two years, Cylance has collected over 8GB of data including over 80,000 files of exfiltrated data, hacker tools, victim logs, and highly sensitive reconnaissance data.


Input: • Data from sinkholed command and control servers has allowed us to track this active campaign.


Input: • Cylance is releasing more than 150 IOCs and samples associated with the Cleaver campaign to empower the security community to detect existing compromises in their own organizations, as well as potentially block future attacks from these teams.


Input: • This campaign continues Iran's retaliation for Stuxnet, Duqu, and Flame.


Input: • This is a state-sponsored campaign.


Input: • There is a possibility that this campaign could affect airline passenger safety.


Input: • This campaign's intentions may be to damage Industrial Control Systems (ICS), Supervisory Control and Data Acquisition (SCADA) systems, and impact Critical Infrastructure and Key Resources (CIKR).


Input: • This campaign could be a way to demonstrate Iran's cyber capabilities for additional geopolitical leverage, due to the breadth and depth of their global targets.


Input: • There is an intense focus on CIKR companies in South Korea, which could give Iran additional clout in their burgeoning partnership with North Korea.


Input: In September 2012, Iran signed an extensive agreement for technology cooperation agreement with North Korea, which would allow for collaboration on various efforts including IT and security.


Input: • Iran is recruiting from within the universities and potentially using'hackers for hire'.


Input: The Cleaver team targets some of the most sensitive global critical infrastructure companies in the world, including military, oil and gas, airlines, airports, energy producers, utilities, transportation, healthcare, telecommunications, technology, manufacturing, education, aerospace, Defense Industrial Base (DIB), chemical companies and governments.


Input: Countries impacted include Canada, China, England, France, Germany, India, Israel, Kuwait, Mexico, Pakistan, Qatar, Saudi Arabia, South Korea, Turkey, United Arab Emirates, and the US.


Input: The following is a breakdown by country of which industries were targeted and/or victimized: Cleaver's level of access into each organization varied greatly, including completely compromised systems and networks, Active Directory domain controllers and credentials, compromised data repositories and stolen VPN credentials.

Cleaver's level of access into each organization

completely compromised systems and networks

Active Directory domain controllers and credentials

compromised data repositories

stolen VPN credentials

including


Input: Compromised systems include Microsoft Windows web servers running IIS and ColdFusion, Apache with PHP, many variants of Microsoft Windows desktops and servers, and Linux servers.

Compromised systems

Microsoft Windows web servers running IIS and ColdFusion, Apache with PHP, many variants of Microsoft Windows desktops and servers, and Linux servers

include


Input: Compromised network infrastructure included Cisco VPNs as well as Cisco switches and routers.

Compromised network infrastructure

Cisco VPNs as well as Cisco switches and routers

included


Input: Unlike Stuxnet, no exotic exploitations (such as 0-days) were observed.


Input: Within our investigation, we had no direct evidence of a successful compromise of specific Industrial Control Systems (ICS) or Supervisory Control and Data Acquisition (SCADA) networks, but Cleaver did exfiltrate extremely sensitive data from many critical infrastructure companies allowing them to directly affect the systems they run.

Cleaver

extremely sensitive data

many critical infrastructure companies

exfiltrate

from


Input: This data could enable them, or affiliated organizations, to target and potentially sabotage ICS and SCADA environments with ease.

them, or affiliated organizations

ICS and SCADA environments

ease

target and potentially sabotage

with


Input: We discovered over 50 victims in our investigation, distributed around the globe.


Input: Ten of these victims are headquartered in the US and include a major airline, a medical university, an energy company specializing in natural gas production, an automobile manufacturer, a large defense contractor, and a major military installation.


Input: The four targets in Israel and the five targets in Pakistan are comprised of education, aerospace, airports, airlines, healthcare and technology.


Input: Further victims were identified in numerous Middle Eastern countries as well as ones in Northern Europe including the UK, France, and Germany.


Input: Central America was not immune either with a large oil and gas company on the list.


Input: In fact, oil and gas was a particular focal point for the Cleaver team, going after no less than nine of these companies around the world.


Input: Universities were targeted in the US, India, Israel, and South Korea.


Input: The attackers targeted research efforts, student information, student housing, and financial aid systems.

The attackers

research efforts, student information, student housing, and financial aid systems

targeted


Input: They had a penchant for pictures, passports, and any specifc identifying information.


Input: Perhaps the most bone-chilling evidence we collected in this campaign was the targeting and compromise of transportation networks and systems such as airlines and airports in South Korea, Saudi Arabia and Pakistan.


Input: The level of access seemed ubiquitous: Active Directory domains were fully compromised, along with entire Cisco Edge switches, routers, and internal networking infrastructure.

Active Directory domains

entire Cisco Edge switches, routers, and internal networking infrastructure

were fully compromised

along with


Input: Fully compromised VPN credentials meant their entire remote access infrastructure and supply chain was under the control of the Cleaver team, allowing permanent persistence under compromised credentials.

Fully compromised VPN credentials

their entire remote access infrastructure and supply chain was under the control of the Cleaver team

permanent persistence

compromised credentials

meant

allowing

under


Input: They achieved complete access to airport gates and their security control systems, potentially allowing them to spoof gate credentials.

They

complete access to airport gates and their security control systems

them

spoof gate credentials

achieved

allowing

to


Input: They gained access to PayPal and Go Daddy credentials allowing them to make fraudulent purchases and allowed unfettered access to the victim's domains.

They

access to PayPal and Go Daddy credentials

them

make fraudulent purchases

unfettered access to the victim's domains

gained

allowing

allowed

to


Input: We were witnessed a shocking amount of access into the deepest parts of these companies and the airports in which they operate.


Input: Despite today's trend toward attacker attribution, we believe it offers little real benefit to the day-to-day cyber defender.


Input: However, in this report we offer our observations on the sources of Operation Cleaver in order to benefit those that rely on attribution such as Law Enforcement.


Input: Operation Cleaver is believed to consist of at least 20 hackers and developers, collaborating on projects and missions to support Iranian interests.


Input: Many of the targets were predominately English-speaking and a majority of the team members were capable of reading and writing in English.


Input: We present evidence that this team is operating, at least in part, out of Iran and in the interests of Iran.


Input: The skills and behavior of the Operation Cleaver teams are consistent with, and in one case surpasses, Iran's cyber capabilities as we know them today.


Input: For a complete list of IPs and domains related to this campaign, please refer to the Indicators of Compromise section.


Input: Over the course of multiple incident response engagements related to Operation Cleaver, we were able to identify a small set of IP addresses which were commonly used during the initial stages of an attack.

a small set of IP addresses

the initial stages of an attack

were commonly used

during


Input: The IP address 78.109.194.114 served as a source for one of the primary attackers.

The IP address 78.109.194.114

a source for one of the primary attackers

served

as


Input: They were observed conducting SQL injections, controlling backdoors, as well as exfiltrating information using this address, and the address appears in multiple software configurations recovered from staging servers over a period of time.

They

SQL injections

backdoors

information

this address

conducting

controlling

exfiltrating

using


Input: This IP address was also observed in multiple software configurations.


Input: This particular net block was used over an extended period of time, indicating these were under the Cleaver team's physical control.


Input: Additionally, prior netblocks used by the same team demonstrated to us that this wasn't simply a case of proxying or'' island hopping''.


Input: For more information see the Tarh Andishan section of this report.


Input: The IP address 159.253.144.209 was a source for a secondary attacker in various compromises.

The IP address 159.253.144.209

a source for a secondary attacker in various compromises

was


Input: They were observed conducting SQL injection attacks.

They

SQL injection attacks

conducting


Input: While this IP was this registered in the Netherlands, we believe they used Softlayer's Citrix demo environment to launch these attacks which is consistent with proxying or'' island hopping''.


Input: A number of Cleaver's attack methods require a persistent server.


Input: In many cases, these servers were referenced by domain names.


Input: The following malicious domains are operated by this organization and are grouped by the registrant's email address.


Input: As is typical with malicious domains, the Whois data for most of these domains contained falsified information.


Input: We managed to obtain a large collection of the internally developed tools used by the Cleaver team, many of which were developed by its members.


Input: Due to operational security failures, these tools contain information that provided us insight into their organization and operations.


Input: In the tool named Shell Creator 2, there are three main components.


Input: The creator generates an ASPX web shell using user input as well as a collection of templates.

The creator

an ASPX web shell

user input as well as a collection of templates

generates

using


Input: The web shell could then be installed via xpcmdshell, or any other method which would grant the attacker write access.

The web shell

xpcmdshell, or any other method which would grant the attacker write access

be installed

via


Input: The web shell is accessible by the shell client directly.


Input: The shell client is a portion of Shell Creator 2 that was not designed to be run on a compromised computer.


Input: We originally located it on a staging server being utilized for multiple attacks as well as a tool for sharing data between members of the organization's team.

a staging server

multiple attacks as well as a tool for sharing data between members of the organization's team

being utilized

for


Input: The shell client, which is developed in Java and is easily decompiled, is a simple interface with a feature to protect the operator from making a critical mistake.


Input: When executed, and before any connection to an instance of the web shell is initiated, the shell client communicates with freegeoip.net in order to get the external IP address of the current user.

the shell client

freegeoip.net

get the external IP address of the current user

communicates

with

in order to


Input: The country of origin is then shown to the user, to inform them of what country it appears they are connecting from.


Input: The assumed purpose of this feature is to ensure that a proper proxy is in use, and the real origin of the attacker is not revealed.


Input: After decompiling the shell client, we found the following code segment controlling the display of this IP location information.


Input: This code handles the XML response from freegeoip.net, and displays the information as different colors based on different attributes.


Input: For instance, if the string'' ERROR'' is in the response, the text is displayed with the color magenta.


Input: If the string IRAN is in the response, the text is displayed with the color red.


Input: It should be noted that no other country name contains the substring IRAN.


Input: Net Crawler is a tool developed in C #that exhibits worm-like behavior in order to gather cached credentials from any and all accessible computers on an infected network.

Net Crawler

worm-like behavior

cached credentials

any and all accessible computers on an infected network

exhibits

gather

from


Input: This is done with Windows Credential Editor (WCE) and Mimikatz in combination with PsExec.


Input: Different versions of this malware contain ASCII art which names the authoring group as Zhoupin (in'' leetspeak'' as'' Zh0up! n'').


Input: For more information on Net Crawler, see the Tactics, Techniques and Procedures section.


Input: TinyZBot is a bot written in C #and developed by the Cleaver team.


Input: It is the longest developed malware family discovered by this group, and has been used in campaigns for close to two years.


Input: How it operates can vary greatly from version to version.


Input: For a detailed technical analysis of TinyZBot, see the Tactics, Techniques and Procedures section.


Input: As TinyZBot is developed in C #, many versions can be decompiled to code very similar to their originals, including names of namespaces.


Input: Many versions were obfuscated with a legitimate tool for developers named SmartAssembly, which makes the recovery of some names implausible.

Many versions

a legitimate tool for developers named SmartAssembly

were obfuscated

with


Input: We obtained multiple versions from which we were able to recover many of the original names of variables and namespaces.


Input: In a number of these samples, the primary namespace for TinyZBot is named ZhoupinCleaver.


Input: In every version of TinyZBot that is not obfuscated, there is a code base referred to as Cleaver.


Input: This code base is also shared in other malware developed by this organization, such as Csext.


Input: PrivEsc is a blatant plagiarism of an existing exploit for Microsoft Windows released in January 2010 called MS10-015,'' Vulnerabilities in Windows Kernel Could Allow Escalation of Privilege'', popularly known as the KiTrap0D exploit which was released publicly.


Input: The Cleaver team clearly modified the source code and compiled a new version.


Input: The only detectable modification was to change the original author's name to instead display the following: Zhopin Exploit Team This is not the only case of this team relabeling others' work as their own.


Input: Logger module is a component of the PVZ (PVZ is shorthand for Parviz, one of the members of the Cleaver team) bot tool chain.


Input: When executed, it will capture the user's keystrokes and save them to a location which PVZ bot then exfiltrates.

it

the user's keystrokes

them

a location

PVZ bot

capture

save

exfiltrates

to


Input: The logger module binary's file description value is the following: Roughly translated from Persian, this text says: This text could potentially be a note intended to stay internal, or could be an attempt to persuade an unsuspecting victim to assume the file is not malicious.


Input: The Product Name value is GOOD FILE.


Input: For more information on the PVZ bot tool chain, see the Tactics, Techniques, and Procedures section.


Input: CCProxy is a publicly available proxy server for Windows, which can handle a variety of protocols.


Input: We do not believe that this organization was involved in the development or modification of CCProxy, but they have been observed using it.


Input: We recovered a CCProxy configuration, which exposed various operational details.


Input: The configuration allowed for remote connections, limited by a username as well as a limited IP range.


Input: The username was User-001, which is the default value.


Input: The limited IP range covered one IP: 78.109.194.114.


Input: This IP address is located in Iran, and is owned by Tarh Andishan.


Input: The configuration also indicates which address the CCProxy server should listen on for incoming connections such as web (80) and mail (25).


Input: Log output from the network port scanning application NMAP was recovered from a staging server.


Input: This log was generated during the usage of the nbrute utility, which brute-forces network credentials and relies on NMAP to do so.

the nbrute utility

network credentials

brute-forces


Input: The header of this NMAP log indicates that the computer used to run nbrute/nmap was set to Iran Daylight Time at the time of execution.


Input: With no known victims located in Iran, it is likely that this was executed on an attacker's computer, and not on a victim's computer.


Input: A configuration file for a Squid proxy server was recovered.


Input: Figure 12: Squid configuration file showing the use of Tarh Andishan's IP address.


Input: The net range of 78.109.194.114/28 was inserted into the allowed local networks with an RFC comment appended in order to make it look like it was part of the default configuration.


Input: It is likely this is the same reason a /28 net range was used, in order to not look like it was intended to only allow one IP.


Input: This would give the same access to resources accessible from the Squid proxy server to this Iranian IP address.


Input: Tarh Andishan is listed as the registrant for a number of small net blocks based upon the email address tarh.andishan (at) yahoo.com.


Input: The net blocks appear to rotate over time and registrant information is altered to accommodate ongoing operations and avoid potential public exposure.


Input: The networks are included below as well as the last time that net block was observed as active.


Input: There are many seemingly legitimate Tarh Andishan related companies inside Tehran, but strong connections to Iranian backing have been difficult to prove definitively.


Input: '' Tarh Andishan'' is often translated as'' Thinkers'','' Innovators'' and'' Inventors''.


Input: The net blocks above have strong associations with state-owned oil and gas companies.


Input: These companies have current and former employees who are ICS experts.


Input: Tarh Andishan has been suspected in the past of launching attacks in the interest of Iran.


Input: The operators of the blog IranRedLine.org, which comments on Iran's nuclear weapons efforts, has mentioned in multiple posts having been the target of debilitating brute-force authentication attacks from IP addresses registered to the same Tarh Andishan team found in Cleaver.

The operators of the blog IranRedLine.org, which comments on Iran's nuclear weapons efforts

multiple posts

having been the target of debilitating brute-force authentication attacks from IP addresses registered to the same Tarh Andishan team found in Cleaver

mentioned

in


Input: In one of IranRedLine.org's blog posts, the author speculates on Tarh Andishan's involvement with the Iranian government by showing close proximity to SPND, the Organization of Defensive Innovation and Research; however, the phone number listed under the registrant contact information has yet to be completely validated.


Input: During this investigation, we were able to compile a considerable amount of information on some of the members of this organization.


Input: The following profiles were built from reverse engineering, code analysis, open source intelligence, incident response and forensics work.


Input: Personally identifiable information about these members is not being shared publicly as it could endanger their lives and would be irresponsible.


Input: Parviz is a developer who worked on a variety of projects, and was primarily active in 2013.


Input: His development skillset is based around his ability to develop in C/C++.


Input: He has been observed using Visual Studio 2010, and his tools are written exclusively for Windows.


Input: Some of his tools were found to be packed with ASPack.


Input: Parviz is the primary developer of the PVZ bot and multiple parts of its tool chain.


Input: Parviz is likely associated with the PVZ bot as his name in hardcoded into the PDB file paths.


Input: The PVZ tool chain includes a variety of functionality, such as HTTP command and control communications with an ASPX server-side component, a denial of service tool they developed, and the public project named XYNTService used to run ordinary applications as services.

The PVZ tool chain

HTTP command and control communications with an ASPX server-side component

a denial of service tool they developed

includes


Input: Nesha is one of the offensive members of this organization.


Input: Nesha was seen in breaches involving SQL injection as well as other techniques.

Nesha

breaches involving SQL injection as well as other techniques

was seen

in


Input: Nesha often utilized web-based backdoors developed in ASPX, PHP as well as ColdFusion.

Nesha

web-based backdoors developed in ASPX, PHP as well as ColdFusion

utilized


Input: A copy of an MS08-067 exploit developed in Python was recovered in which Nesha shamelessly replaced the original author's name with his own.


Input: Nesha's passwords very commonly include own handle.


Input: His passwords were frequently stored as hashes in backdoors, but common hash cracking methods were able to recover the plaintext versions.


Input: His observed password use is as follows: Cylance observed Nesha participating in compromises involving the following techniques: Nesha has additionally been identified using a variety of internally developed tools as well as the following publicly available tools: Alireza appears to be one of the senior developers of this organization.


Input: His tools are commonly developed in C++, Java, and C #(desktop and ASPX).


Input: These tools are often support tools, either monitoring the activity of other tools or supplementing the function of other tools gathering information during the infiltration process.

These tools

the activity of other tools

the function of other tools gathering information during the infiltration process

monitoring

supplementing


Input: Alireza's code appears to be reused internally on projects such as TinyZBot.


Input: Alireza appears to be using a version control system for his code, and it is likely that others are using the same system.


Input: Based on the paths, the version control system in use is likely Apache's Subversion.


Input: Use of a version control system is indicative of code sharing, but the use of an older system like Subversion, along with other evidence, suggests there is not a large amount of collaboration on projects and likely one developer working on each project at a time.


Input: This is not behavior typical of a professional development team.


Input: Alireza's C #tools include the following techniques: Alireza's Java tools include the following techniques: Alireza's C++ tools include the following techniques: kaJ is a .NET


Input: developer, and has only been observed working in C #.


Input: He has less English language proficiency than others in the organization, and likely has a supplemental role during compromises.


Input: He has been observed developing tools which cater to specific challenges in a compromise.


Input: His notable project was named Net Crawler, and a technical analysis of this tool can be found in the Tactics, Techniques and Procedures section.


Input: Thanks to a recovered test configuration for Net Crawler, we were able to determine that kaJ's development computer has the name dev-castle, where he has the username kaJ and the password oaolrJ @vad.


Input: kaJ is believed to be the creator of the Zhoupin ASCII art displayed in Net Crawler.


Input: kaJ's projects include the following techniques.


Input: Jimbp is a .NET


Input: developer with minimal experience.


Input: His projects appear to be supplemental to TinyZBot and are very simplistic.


Input: It is believed he is the developer of the project Binder1.


Input: This project was a simple malware binder which required manual configuration when compiling.


Input: His other work included creating a new service wrapper for TinyZBot.


Input: Of course many associated Iranian hacker teams have been identified in public and private security circles.


Input: Some of the teams publicly known today include Iranian Cyber Army, Ashiyane, Islamic Cyber Resistance Group, Izz ad-Din al-Qassam Cyber Fighters, Parastoo, Shabgard, Iran Black Hats and many others.


Input: However, even though the TTPs of the Cleaver team have some overlap to techniques used by Iranian Cyber Army (botnets), Ashiyane (SQL injection) and Syrian Electronic Army (phishing and RATs), we believe this is largely the work of a new team.


Input: Some connections to Ashiyane were discovered in our investigations including a reference to hussein1363, who had prior ties to the hacker group.


Input: Additional connections between team members and individuals exist but are predominantly speculative and have only been shared with law enforcement.


Input: Ultimately we believe the Cleaver team is a mix of existing team members and new recruits pulled from the universities in Iran.


Input: The Cleaver campaign used a variety of methods in multiple stages of attacks.


Input: In this section we'll cover the commonly observed methods during different stages of the attack.


Input: The initial compromise gets the attackers their first foothold into the target network.


Input: Once the ability to execute arbitrary code has been established, an attacker's job becomes quite a bit easier.


Input: Since the vector of initial compromise is usually determined by what is vulnerable on the target, we'll cover just a few of the techniques we've seen Operation Cleaver use to initiate the compromise.


Input: SQL injection is a very common and simple attack method.

SQL injection

a very common and simple attack method

is


Input: It is made possible by a lack of input sanitization by the vulnerable application before supplying that input into a SQL database query.


Input: SQL injection payloads used by this organization have been double encoded.

SQL injection payloads

this organization

used

been double encoded


Input: Double encoding SQL injection payloads allows for bypassing of various anti-exploitation filters, such as those supplied by Web Application Firewalls (WAFs).

Double encoding SQL injection payloads

bypassing of various anti-exploitation filters, such as those supplied by Web Application Firewalls (WAFs)

allows

for


Input: The attackers would enable xpcmdshell: Then connect outbound via anonymous FTP: Using messaging methods such as email, attackers can social engineer users into downloading and executing software, which quietly installs malware alongside of the desired program.

connect

social engineer

installs

outbound

anonymous FTP

messaging methods such as email

attackers

users

downloading and executing software

malware

the desired program

via

Using

into

alongside of


Input: Operation Cleaver has employed this technique numerous times across different organizations.


Input: The domain EasyResumeCreatorPro.com was registered and a website setup which was a direct copy of a legitimate website at winresume.com.


Input: This is how the original site looked: That's not all they copied.


Input: In order to infect users, they combined the original Easy Resume Creator Pro product with malware by using a binder they developed internally named Binder1.

they

the original Easy Resume Creator Pro product

malware

using a binder they developed internally named Binder1

combined

with

by


Input: A binder is an application, which combines two executables (desired software and malware) into a single executable.


Input: The resulting executable masquerades as the desired software.

The resulting executable

the desired software

masquerades

as


Input: The purpose is deception, to make the binder indistinguishable from the desired application.

make

the binder

indistinguishable from the desired application


Input: When executed, both applications are written to a temporary directory and executed.

both applications

a temporary directory

are written

executed

to


Input: This way it appears that the desired application was executed, but the malware was also executed silently.

the malware

was also executed


Input: This attack evolved to appear more legitimate.


Input: The attackers made the victims feel like they had a pending job opportunity at the industrial conglomerate Teledyne.


Input: In order to take advantage of this job opportunity, the victim needed to use the fake résumé submission application supplied by the malicious recruiter.

In order to

take advantage of this job opportunity

the victim

the fake résumé submission application supplied by the malicious recruiter

use


Input: Multiple domains were registered in order to make the download sites seem more realistic.

Multiple domains

make the download sites seem more realistic

were registered

in order to


Input: These domains included other companies as they tried to hit a wider audience.


Input: At this point, the résumé submission application checks the Internet connection.

the résumé submission application

the Internet connection

checks


Input: If it is unable to connect to the Internet, it will display a window to input proxy information.

it

a window

input proxy information

display

to


Input: When this information is entered, the results are cached in a location the dropped malware can access.

the results

a location the dropped malware can access

are cached

in


Input: After an Internet connection is ensured, the malware (TinyZbot) is dropped and executed.

an Internet connection

the malware (TinyZbot)

is ensured

is dropped

executed


Input: This clever scheme makes sure the malware can connect to the command and control server, and increases the chances that domain credentials are cached on the now infected machine.

the malware

the command and control server

connect

to


Input: Shortly after, the main application is launched.

the main application

is launched


Input: The first résumé submission form requests contact information.

The first résumé submission form

contact information

requests


Input: This form, like the rest of the submission forms, only stores the submitted information while the application is running.

This form

the submitted information

the application is running

stores

while


Input: As the infected user is going through and filling out all this information, the malware is running in the background, logging their keystrokes, retrieving their stored passwords, etc.

the malware

their keystrokes

their stored passwords

logging

retrieving


Input: Once all the forms are filled out, the user goes to the submission form.


Input: When the victim hits submit, the résumé submitter does a GET request to microsoft.com in order to make it seem like it is submitting something, then claims success.

When

to

in order to

the victim hits submit

the résumé submitter

a GET request

microsoft.com

make it seem like it is submitting something

does


Input: This method is particularly effective not only because of its level of deception, but even if the victim suspects that they are infected with malware, they are not as likely to speak up about it, as they would need to explain why they were submitting a job application for another company.


Input: Privilege escalation is a category of techniques that describe the process of going from a less privileged user on a compromised computer to a more privileged user.

Privilege escalation

a category of techniques that describe the process of going from a less privileged user on a compromised computer to a more privileged user

is


Input: This increase in privileges allows for the attacker to gain access to privleged areas of the operating system as well as to infect other computers on the target network.

This increase in privileges

the attacker

access to privleged areas of the operating system

other computers on the target network

allows

gain

infect


Input: This team did not utilize any novel methods of privilege escalation, but they were observed using a variety of publicly known exploits.


Input: PrivEsc is a compiled exploit, which leverages the vulnerability commonly referred to as KiTrap0D (CVE-2010-0232).

PrivEsc

the vulnerability commonly referred to as KiTrap0D (CVE-2010-0232)

leverages


Input: The exploit allows for escalation of privileges on unpatched Windows operating systems from an unprivileged user to kernel-level privilege.

The exploit

escalation of privileges on unpatched Windows operating systems from an unprivileged user to kernel-level privilege

allows

for


Input: This vulnerability and the corresponding exploit were discovered and developed in 2010.


Input: The plagiarized version used in Operation Cleaver was compiled in May 2013, with a slight modification to the public source code.


Input: This modification changed the author's details to Zhopin Exploit Team.


Input: Pivoting is the process of leveraging access from one compromised computer in order to gain access to additional systems on the target network.

Pivoting

the process of leveraging access from one compromised computer in order to gain access to additional systems on the target network

is


Input: This can involve launching attacks from the compromised computer, or simply abusing access once it has been gained.

launching

abusing

attacks

the compromised computer

access

it has been gained

from

once


Input: A very common method of pivoting on a predominantly Windows operating system based network is to extract domain credentials which have been used on the compromised computer from a credential cache.

extract

domain credentials which have been used on the compromised computer from a credential cache


Input: There are a few well-known tools which are capable of doing this given sufficient privileges on the infected host.

a few well-known tools

sufficient privileges on the infected host

given


Input: Two of these tools used by Cleaver are Mimikatz and Windows Credential Editor.


Input: Two similar applications were developed by Operation Cleaver in order automate the execution of Mimikatz.

Two similar applications

the execution of Mimikatz

automate


Input: These applications are zhMimikatz and MimikatzWrapper.


Input: These applications store multiple versions of Mimikatz in their resources.


Input: When executed, they determine which version of Mimikatz to use based on whether the computer's version of Windows is 32-bit or 64-bit.

they

which version of Mimikatz to use

whether the computer's version of Windows is 32-bit or 64-bit

determine

based on


Input: This technique is uncommon in malware and shows the advanced skillset of the Cleaver team.


Input: Both tools were developed in C #.


Input: In the following examples, the computer name is TheComputerName, the username of the logged in user is TheUser, and that user's password is ThePassword.


Input: At the time of execution, the system only has its own credentials available and no cached network credentials.


Input: zhMimikatz executes the correct version of Mimikatz for the current system, and parses the results for any cached credentials.

zhMimikatz

the correct version of Mimikatz for the current system

the results

any cached credentials

executes

parses

for


Input: Output from MimikatzWrapper is essentially the same as zhMimikatz, despite being a different Visual Studio project.


Input: The only external difference is that MimikatzWrapper also logs these results to res.txt in the executing directory.

MimikatzWrapper

these results

res.txt

the executing directory

logs

to

in


Input: This can make it useful for tools like the PVZ tool chain and Csext to execute with logged results: Once an attacker has credentials extracted from the cache, whether in hash form or in plaintext form, PsExec can be used to run commands on any other computer which accepts those domain credentials.

tools like the PVZ tool chain and Csext

logged results

an attacker

credentials

the cache

PsExec

commands

any other computer which accepts those domain credentials

execute

extracted

run

with

from

on


Input: If this technique is combined with cached credential dumping, it can be used to jump from computer to computer on a compromised network.

this technique

cached credential dumping

it

computer

computer

a compromised network

is combined

jump

with

from

to

on


Input: Net Crawler utilizes a cached credential dumping technique along with PsExec in order to worm throughout a network, collecting any and all credentials that it can extract from credential caches.

Net Crawler

a cached credential dumping technique

PsExec

a network

any and all credentials that it can extract from credential caches

utilizes

worm

collecting

along with

throughout


Input: It has the ability to do this with both Windows Credential Editor and Mimikatz.


Input: It starts by first extracting cached credentials from the infected computer's cache.

It

cached credentials

the infected computer's cache

extracting

from


Input: Once this is complete, it then continues to scan a set of configured IP addresses on the local subnet to determine which IP addresses have SMB related ports open.

it

a set of configured IP addresses

the local subnet

determine which IP addresses have SMB related ports open

scan

on

to


Input: Then an iterative methodology is applied to brute forcing each SMB enabled target with each credential that was extracted from the cache.

an iterative methodology

each SMB enabled target

each credential that was extracted from the cache

brute forcing

with


Input: When a positive result has been achieved, it will create a copy of itself with a modified configuration stored as a PE resource, then send and execute the copy utilizing PsExec.

it

a copy of itself

a modified configuration stored as a PE resource

the copy utilizing PsExec

create

send

execute

with


Input: This copy repeats the behavior of the original, but with already discovered credentials as well as newly discovered ones on the newly infected host.

This copy

the behavior of the original

already discovered credentials as well as newly discovered ones on the newly infected host

repeats

but with


Input: Any credentials found are reported back to the original infection.


Input: The following is a sample of some of the recovered results of Net Crawler executing on a live network: A more in depth analysis of Net Crawler, as part of the A Study in Bots series, will be available on Cylance's blog.


Input: MS08-067 is a vulnerability in Microsoft Windows made popular by the Conficker worm which can be exploited by a specially crafted packet to the operating system's RPC network interface.

a vulnerability in Microsoft Windows made popular by the Conficker worm which can be exploited by a specially crafted packet to the operating system's RPC network interface

is


Input: This vulnerability has been patched since October 2008, but many networks have failed to update their systems even to this day.


Input: Operation Cleaver used a plagiarized version of a publicly available exploit for this vulnerability developed in Python.


Input: Someone in the Cleaver team (presumed to be Nesha) modified the exploit to read'' By Nesha''.


Input: Jasus is an ARP cache poisoner developed by the Operation Cleaver team.

Jasus

an ARP cache poisoner developed by the Operation Cleaver team

is


Input: It makes use of WinPcap and is developed in C. Compared to some other publicly available ARP cache poisoning utilities, Jasus is poorly developed and without many useful features.


Input: The primary positive attribute of Jasus is its poor detection ratio by the antivirus industry.

The primary positive attribute of Jasus

its poor detection ratio by the antivirus industry

is


Input: Cain & Abel is a publicly available toolkit, which covers a wide range of functionality that assists attackers once they have compromised a node on a network.


Input: It has the ability to dump stored and cached credentials, and conduct attacks like ARP cache poisoning in order to capture credentials being transmitted on the network.

It

stored and cached credentials

attacks like ARP cache poisoning

credentials being transmitted on the network

dump

conduct

capture


Input: It also has a remotely installable trojan named Abel, which enables some of its functionality on a remote target.

It

a remotely installable trojan named Abel

some of its functionality

a remote target

has

enables

on


Input: We observed the Operation Cleaver team using Cain & Abel for extracting credentials from caches and the network when they are confident that there is little to no antivirus protection on the infected target.

the Operation Cleaver team

Cain & Abel

extracting credentials from caches and the network

using

for


Input: Exfiltration is the process of moving information to an external site.

Exfiltration

the process of moving information to an external site

is


Input: In this context, it is the process of stealing information without being detected.

it

the process of stealing information without being detected

is


Input: Operation Cleaver has a strong focus on stealing confidential/privileged information, and they have utilized a few methods in order to facilitate this objective.

Operation Cleaver

confidential/privileged information

stealing


Input: Cleaver Operations observed in 2013 mainly utilized FTP servers with anonymous access enabled in order to pilfer large quantities of information.

Cleaver Operations

FTP servers

anonymous access enabled

pilfer large quantities of information

utilized

with

in order to


Input: This allowed them to use existing command line utilities available on their targets in order to upload information.

them

existing command line utilities available on their targets

information

use

upload


Input: This is a versatile technique as it does not require any additional software which could be detected.


Input: These FTP servers were also observed during the infection process, as infected computers were often instructed to download additional files from these FTP servers, including backdoors and pivoting tools.

These FTP servers

the infection process

infected computers

additional files

these FTP servers

were also observed

download

during

from


Input: The following IP addresses hosted FTP servers that were used in the infection of targets or in the exfiltration of information.

The following IP addresses

FTP servers

the infection of targets

the exfiltration of information

hosted

were used

in

in


Input: NetCat is a network tool which has many valid purposes but can also be used for malicious purposes.


Input: Its main functionality allows for a client and server communication channel, allowing for information to be transported over the network simply.

Its main functionality

a client and server communication channel

information to be transported over the network simply

allows

allowing

for

for


Input: NetCat has an option when being compiled to enable or disable the ability for NetCat to execute a command after the connection is established.

NetCat

a command

the connection is established

execute

after


Input: This feature can be abused to enable a reverse connecting shell, which can be used to remotely control a target.

This feature

a reverse connecting shell

a target

enable

remotely control


Input: NetCat's network communications are in plaintext, and could be viewed by an egress filter looking to block the exfiltration of sensitive information.


Input: The Operation Cleaver team was observed attempting to use NetCat to exfiltrate information as well as use it as a reverse connecting shell.

The Operation Cleaver team

NetCat

exfiltrate information

it

a reverse connecting shell

use

use

to

as


Input: The use of NetCat was later replaced with zhCat.


Input: zhCat is a tool developed by the Operation Cleaver team which operates similarly to NetCat.


Input: Its main purpose is to create a channel that is capable of transporting information over the network.

Its main purpose

a channel that is capable of transporting information over the network

create


Input: The changes made in zhCat allow for this information to be transferred with inline obfuscation and/ or encryption.

zhCat

this information

inline obfuscation and/ or encryption

be transferred

with


Input: This makes it more difficult to detect that privileged information is being exfiltrated.

privileged information

being exfiltrated


Input: The command line help (of a particular version) shows the following options: Multiple obfuscation/encryption methods are available.


Input: The –h argument enables HTTP mode.


Input: This makes the traffic between zhCat instances look like benign HTTP traffic.

This

the traffic between zhCat instances

look like benign HTTP traffic

makes


Input: For instance, if the attackers set up a zhCat instance listening on port 1000 on 192.168.116.128 in HTTP mode, the client instance of zhCat would use the following command: The server instance would use the following command: When we run both of these, we can send information just by typing it into the terminal of the running application.


Input: Information can be supplied by standard input.


Input: If we observe the network communications during this transfer, we can see the following HTTP POST request.

we

the following HTTP POST request

see


Input: Note: research into ebizmba.com did not turn up any additional evidence of being involved with the development of zhCat.


Input: On the server side, we can see our message has been received: If stricter egress filtering is enabled, the attackers can use zhCat to also XOR encrypt the traffic with a shared key.

the attackers

zhCat

also XOR encrypt the traffic with a shared key

use

to


Input: These keys are stored inside zhCat.


Input: The following is the key used for XOR encryption: The \n represents hex character 0x0A, which is a new line character.

the key

XOR encryption

used

for


Input: An attacker could set up a server instance of zhCat with the following command in order to enable both HTTP and XOR obfuscation: The client instance could then be invoked with the following command: Once again, information can be supplied via standard input.

An attacker

a server instance of zhCat

the following command

enable both HTTP and XOR obfuscation

set up

with

in order to


Input: Upon inspecting the network traffic again, we see the following HTTP POST request.

we

the following HTTP POST request

see


Input: On the server side, we can see this information being received: zhCat has a variety of other features such as port mirroring as well as traffic redirecting.

zhCat

a variety of other features such as port mirroring as well as traffic redirecting

has


Input: PLink is one of the many utilities provided in the PuTTY (SSH) suite, which has many benign purposes.


Input: It is capable of communicating over various protocols, the most notable being SSH.


Input: The SSH protocol is a heavily utilized encrypted protocol, most commonly used for remote administration of UNIX based operating systems.


Input: PLink is designed to implement some of the SSH functions related to forwarding traffic as well as other functionality.


Input: Operation Cleaver uses PLink to forward local RDP ports to remote SSH servers.

Operation Cleaver

PLink

forward local RDP ports to remote SSH servers

uses

to


Input: This allows them to easily connect to RDP servers inside the networks of their victims.

them

RDP servers

the networks of their victims

connect

to

inside


Input: These RDP connections can be used to exfiltrate information visually, as well as to remotely control the computers hosting the RDP servers.

These RDP connections

information

the computers hosting the RDP servers

exfiltrate

remotely control


Input: Early Cleaver operations abused SMTP in order to exfiltrate information.

Early Cleaver operations

SMTP

exfiltrate information

abused

in order to


Input: The sending is performed by internally developed malware samples such as TinyZBot and Csext in order to exfiltrate information about the infected computer, as well as requested files and keystroke logging information.

The sending

internally developed malware samples such as TinyZBot and Csext

exfiltrate information about the infected computer, as well as requested files and keystroke logging information

is performed

in order to


Input: Messages were sent using an open SMTP relay at BeyondSys.com with the sender email address dyanachear (at) beyondsys.com.

Messages

an open SMTP relay at BeyondSys.com

the sender email address dyanachear (at) beyondsys.com

were sent

using

with


Input: This allowed the attackers to use infrastructure that was not theirs to exfiltrate information.

the attackers

infrastructure that was not theirs

exfiltrate information

use

to


Input: The known recipient addresses of this information were testmail00001 (at) yahoo.com and TerafficAnalyzer (at) yahoo.


Input: com.


Input: In order to deceive anyone reading these emails, they made them appear to be a spam message that most would not think twice about.


Input: The subject used is the following: The message used is the following: The files being exfiltrated are added to the email as attachments.

The files being exfiltrated

the email

attachments

are added

to

as


Input: SOAP is a sub-protocol communicated via HTTP.

SOAP

a sub-protocol communicated via HTTP

is


Input: In relation to Operation Cleaver, it is used as the command and control protocol for TinyZBot, which was the preferred backdoor, and underwent long-term development.

it

the command and control protocol for TinyZBot

is used

as


Input: HTTP communications are often used by botnets, but it is uncommon to use a sub-protocol such as SOAP.

HTTP communications

botnets

are often used


Input: It is likely that SOAP was used because it is simple to implement in C #, and has the added benefit of blending in with other benign HTTP traffic.

SOAP

other benign HTTP traffic

blending in

with


Input: As part of TinyZBot's command and control protocol, files can be exfiltrated over SOAP to the command and control server.

files

SOAP

the command and control server

be exfiltrated

over

to


Input: For more information about TinyZBot, see the Persistence section.


Input: Persistence is the means of maintaining access to a compromised network.

Persistence

the means of maintaining access to a compromised network

is


Input: There are limitless methods of persistence; the following are techniques and tools for persistence used by Cleaver.

the following are techniques and tools for persistence

Cleaver

used


Input: TinyZBot is a backdoor developed in C #.

TinyZBot

a backdoor developed in C #

is


Input: This bot is the longest developed malware we have analyzed from this organization.


Input: The earliest known version was compiled in January 2013 and we continued to see new versions being created actively.


Input: The purpose of TinyZBot is to gather information from an infected computer as well as maintain and further access into a compromised network.

TinyZBot

information

an infected computer

access into a compromised network

gather

maintain

further

from


Input: TinyZBot was developed with the clear intention of targeted campaigns.


Input: The name TinyZBot is assumed to be referring to this project as a less versatile version of the ZeuS botnet, although it does not exhibit the major browser injection features of ZeuS.


Input: To be clear, TinyZBot shares no code with ZeuS or its variants, and is developed in a different programming language.


Input: The majority of the code in TinyZBot was created by Cleaver.


Input: TinyZBot supports a wide array of features that continually evolved over time.


Input: For the evolution of features, see the History section.


Input: The following is a list of supported features: The command and control mechanism for TinyZBot utilizes SOAP communicating over HTTP.

The command and control mechanism for TinyZBot

SOAP communicating over HTTP

utilizes


Input: Potential reasons for using SOAP are: 1.


Input: SOAP-based communications are simple to implement in C #.


Input: SOAP traffic could easily be considered benign traffic, as it is not commonly seen in malware.

SOAP traffic

benign traffic

be considered


Input: As part of SOAP communications, a URI is specified.


Input: This is internal to the sub-protocol, and does not necessarily reflect the URI of the host running the SOAP server (ASMX file).


Input: In the case of TinyZBot, and many examples for developing SOAP applications, this URI is tempuri.org.


Input: Since the first version of the SOAP-based command and control protocol was implemented, TinyZBot used what is referred to as a'' dynamic password''.

the SOAP-based command and control protocol

was implemented


Input: The result of this is a cryptographically hashed version of the server time (which must be obtained through a SOAP query), the TinyZBot's GUID, and the TinyZBot's AppUsageID (campaign identifier).


Input: For the command and control examples below, red text represents TCP data sent from the TinyZBot infection while blue text represents TCP data sent from the command and control server.

TCP data

the TinyZBot infection

TCP data

the command and control server

sent

sent

from

from


Input: The server time lookup query invokes the SOAP command GetServerTime.


Input: This is the first query done by a running TinyZBot instance, and needs to be done shortly before most other queries, in order to update the dynamic password.

the first query

a running TinyZBot instance

done


Input: Commands, updates and files to drop and execute are stored as files on the SOAP server, and access is restricted by the AppUsageID as well as the bot GUID.

Commands, updates and files to drop and execute

files on the SOAP server

are stored

as


Input: This allows for commands to be sent to all bots for a campaign as well as individual control.

commands

all bots for a campaign

be sent

to


Input: The TinyZBot queries the server in order to enumerate all files currently available to it.

The TinyZBot

the server

enumerate all files currently available to it

queries

in order to


Input: In order to download the file and parse for commands to execute, the TinyZBot must request the file.

download

request

the file

the TinyZBot

the file


Input: The file is downloaded Base64-encoded inside of the SOAP response.

The file

the SOAP response

is downloaded

inside of


Input: The command file downloaded in this example is as follows: The first line is a timestamp of the command.


Input: The TinyZBot command parser ignores it.


Input: The RUNCMD line requests that cmd.exe be executed, with the command ipconfig /all being redirected to a file in a directory designated for files to be uploaded.

cmd.exe

be executed


Input: The UPLOAD command requests that this file is then uploaded over SOAP to the command and control server.

this file

SOAP

the command and control server

is then uploaded

over

to


Input: The DELETE command then requests that the file be deleted from the infected system.

the file

the infected system

be deleted

from


Input: The following is a list of supported commands that TinyZBot responds to: Commands such as GETINFO are often run on newly infected systems, as they decide whether the infection has hit the correct target.

a list of supported commands

TinyZBot

Commands such as GETINFO

newly infected systems

they

whether the infection has hit the correct target

responds

are often run

decide

to

on


Input: There are additional SOAP commands, but they will not be covered in detail.


Input: The following is a list of all the SOAP commands: CheckFileMD5, GetFile, GetFileList, GetServerTime, UploadFile.


Input: TinyZBot is commonly installed using some form of deception.

TinyZBot

some form of deception

is commonly installed

using


Input: Recent versions use the resume- based methods reported in the Initial Compromise sections.

Recent versions

the resume- based methods reported in the Initial Compromise sections

use


Input: An additional method was used for earlier versions.


Input: When early versions of TinyZBot were executed, they opened an image stored in the resource section of the executable and copied the malicious TinyZBot executable to the% AppData% directory.

they

an image stored in the resource section of the executable

the malicious TinyZBot executable

the% AppData% directory

opened

copied

to


Input: Many of the images identified were of the popular Lebanese singer and actress Haifa Wehbe.


Input: The backdoor additionally replaced the original malicious executable with an appropriately named image file and padded the image file with null bytes in order to mirror the original file size.

The backdoor

the original malicious executable

an appropriately named image file

the image file

null bytes

mirror the original file size

replaced

padded

with

with

in order to


Input: The earliest known version on TinyZBot was compiled on January 27, 2013.


Input: This early version had very little functionality.


Input: It was limited to logging keystroke data, sending emails, and creating a link in the user's startup folder for persistence.

It

keystroke data

emails

a link

the user's startup folder

persistence

logging

sending

creating

in

for


Input: Its method of exfiltrating the logged keystrokes relied upon a hardcoded email address stored in the binary.

Its method of exfiltrating the logged keystrokes

a hardcoded email address stored in the binary

relied

upon


Input: The sender email address was dyanachear (at) beyondsys.com and emails were destined for testmail00001 (at) yahoo.com.


Input: The message was intended to look like common Viagra spam from China, but would be sent with the keystroke logging data as attachments, as well as system information.

The message

the keystroke logging data as attachments, as well as system information

be sent

with


Input: The initial version did not provide any means of receiving commands and was obfuscated with SmartAssembly.

The initial version

SmartAssembly

was obfuscated

with


Input: The following iteration compiled on March 12, 2013, only contained minor bug fixes.


Input: The next version was compiled on April 24, 2013.


Input: This version starts to look more like an average bot.


Input: A command and control protocol was established, using HTTP and SOAP for the protocol.

A command and control protocol

HTTP and SOAP

the protocol

was established

using

for


Input: The command and control server for this version was located at 173.192.144.68/ DefaultWS (dot) asmx.

The command and control server for this version

173.192.144.68/ DefaultWS (dot) asmx

was located

at


Input: This new command and control protocol allowed for the addition of quite a few other features.


Input: An update mechanism was added, and could be regularly scheduled, so unassisted periodic update checks were automatically performed.

unassisted periodic update checks

were automatically performed


Input: The SOAP API used a dynamic password mechanism, which required the computation of a simple key in order to access certain parts of the API.


Input: The email data exfiltration method also underwent modification to be activated at a scheduled interval.

The email data exfiltration method

modification

be activated at a scheduled interval

underwent

to


Input: There were also some changes, which looked to be bug fixes, such as limiting the number of times sending an email could fail.


Input: The next day, April 25, 2013, a new version was compiled which allowed for self-deletion.

a new version

self-deletion

allowed

for


Input: On May 14, 2013, we noticed a change which assisted in the identification of active targets.


Input: The AppUsageId (at this point named AppType) was an identifier used by this organization in order to differentiate between targets infected with TinyZBot, meaning they could effectively run multiple campaigns using the same command and control server and know which target was infected.

The AppUsageId (at this point named AppType)

between targets infected with TinyZBot

they

multiple campaigns

the same command and control server

which target was infected

differentiate

run

know

using


Input: This also allowed for separate commands to be supplied to different targets without the need for per-bot commands.

separate commands

different targets

be supplied

to


Input: At this time, the AppUsageId was total0, but later we observed names, which aligned with active targets.


Input: The exfiltration email address was also changed to TerafficAnalyzer (at) yahoo.com.

The exfiltration email address

TerafficAnalyzer (at) yahoo.com

was also changed

to


Input: On June 17, 2013, there was an addition that allowed for the loading of configuration data from the PE's resources.


Input: At this time, it was limited to the exfiltration email address.


Input: This version was not obfuscated with SmartAssembly We do not see a new version of TinyZBot until June 7, 2014.


Input: There are quite a few notable improvements, but nowhere near enough to indicate consistent development on the project for a year.


Input: SmartAssembly was reused again.

SmartAssembly

was reused


Input: A method was added to detect what security related software is installed.

A method

what security related software is installed

detect


Input: Avira antivirus was specifically targeted and disabled, due to its detection of the new keystroke logger module added in this version.

Avira antivirus

the new keystroke logger module

this version

was specifically targeted and disabled

added

in


Input: This keystroke logger source is publicly available and referred to as DeadkeyLogger.

This keystroke logger source

publicly available and referred to as DeadkeyLogger

is


Input: A new string encryption class is added, but the code was copied and pasted from a Microsoft example.


Input: The ability to extract Internet Explorer passwords was added.

The ability to extract Internet Explorer passwords

was added


Input: Clipboard monitoring code was added, but not invoked.

Clipboard monitoring code

was added


Input: The emailing features were removed, but the classes which previously contained them were still present but empty.


Input: Many more options were enabled to be loaded from PE resources.


Input: The ability to add PE resources was added.


Input: Another version was compiled on June 7, 2014, with no feature difference.


Input: On June 17, 2014, we see2the first instance of Binder1, which is aptly named, as it is a binder.


Input: The legitimate application used in this version of Binder1 was compiled on August 22, 2013, and is a self-extracting archive of desktop wallpapers, including an image from the game Mirror's Edge.


Input: The TinyZBot included was the version compiled on June 7, 2014.


Input: The version compiled on June 23, 2014, added functionality which allowed screenshots of the desktop to be taken.

The version compiled on June 23, 2014

screenshots of the desktop

be taken

allowed

to


Input: On August 2, 2014, we see another version without SmartAssembly obfuscation.


Input: A bug fix is made to the keystroke logging method, and clipboard monitoring is enabled.

A bug fix

the keystroke logging method

clipboard monitoring

is made

is enabled

to


Input: Three items were compiled on August 18, 2014.


Input: Two of them are TinyZBot binaries, which contain a minor key logging bug fix.


Input: The third is a new Binder1 instance, which contains one of the TinyZBot instances compiled that day.


Input: The legitimate application included in this binder is called Easyresumecreator and is a legitimate application named EasyRésuméCreatorPro.


Input: This version targeted a major Saudi Arabian oil company.


Input: From August 23 to August 26, 2014, new versions of TinyZBot were compiled with the AppUsageIds targeting major oil and gas companies in Qatar and Kuwait, Ministries of Foreign Affairs in the Persian Gulf, and a major airline holding company in UAE.


Input: These versions of TinyZBot moved towards a more modular architecture where each component was in its own .NET


Input: assembly.


Input: This was presumably done to limit antivirus detection of each individual file as well as allow for dynamic updating of specific modules.

This

antivirus detection of each individual file

limit


Input: All of these were included in their own Binder1 instance, which also dropped Easyresumecreator.


Input: There also seem to be improved software engineering practices in many locations.


Input: FTP upload support was added, with hardcoded credentials of ano:1.

FTP upload support

hardcoded credentials of ano:1

was added

with


Input: This FTP upload functionality points to the command and control server, and is invoked by a command in the SOAP command and control channel.

This FTP upload functionality

the command and control server

a command in the SOAP command and control channel

points

is invoked

to

by


Input: These versions have the capability to install as a service.

These versions

a service

install

as


Input: On August 25, 2014, the version compiled on August 18 was submitted to VirusTotal in a ZIP archive located at http: //dl.doosan-job (dot) com/cv/EasyResumeCreator- v2.0.zip.


Input: This indicates that TinyZBot is not only being installed while impersonating a résumé creation suite, but is also impersonating potential employers when distributed.

TinyZBot

impersonating a résumé creation suite

potential employers

distributed

being installed

is also impersonating

while

when


Input: On September 9, 2014, a ZIP file containing TinyZBot and a configuration targeting a major US university with its AppUsageId was created.


Input: This was discovered on an anonymous FTP server in the same IP range as dl.doosan-job (dot) com along with other malware.


Input: From September 11 through September 17, 2014, some TinyZBot components were compiled, along with a new dropper.


Input: This dropper impersonated a tool to submit a résumé to Teledyne.

This dropper

a tool to submit a résumé to Teledyne

impersonated


Input: When executed, the user is prompted to enter personal information, and at the end is given a button to submit the résumé to Teledyne, although nothing is actually submitted.


Input: While the user enters this information, their machine is infected with TinyZBot.

While

with

the user enters this information

their machine

TinyZBot

is infected


Input: The AppUsageIds for these versions target a major US-based university as well as an Israeli aerospace company.


Input: These versions began to include a new method of installing as a service.

These versions

a new method of installing as a service

include


Input: The service runs with the name Network Connectivity Manager.


Input: TinyZBot, as well as some other tools (Csext, Net Crawler) initially would not run without a command line parameter set.


Input: This was likely to avoid detonation-based detection engines.

This

detonation-based detection engines

avoid


Input: This command line parameter was opensesemi which is often stored in the application's code in an obfuscated manner.


Input: The binders and droppers for TinyZBot provided this command line argument and others when executing.


Input: TinyZBot uses a dynamic mutex.


Input: This was accomplished by combining a static preset prefix with the active process ID.


Input: This allowed supplemental tools to keep TinyZBot running by enumerating every process and checking if the process ID and mutex prefix existed.

supplemental tools

every process

enumerating


Input: If no mutex and process pair was located, another TinyZBot instance would be started.

If

no mutex and process pair was located

another TinyZBot instance

be started


Input: Multiple backdoors were used by this organization.

Multiple backdoors

this organization

were used


Input: These are scripts or applications that allowed for command or code execution outside of the victim network.

scripts or applications

command or code execution outside of the victim network

allowed

for


Input: Many of their backdoors were web applications, added to web servers, so commands can be executed from a browser or client able to communicate with them.

Many of their backdoors

web applications

commands

a browser or client able to communicate with them

were

be executed

from


Input: This group includes the results of the Shell Creator mentioned in the Attribution section, as well as ASPX backdoors used by Nesha.

This group

the results of the Shell Creator mentioned in the Attribution section, as well as ASPX backdoors used by Nesha

includes


Input: A PHP shell was also observed, which also included attribution to Nesha in its hashed password.

A PHP shell

was also observed


Input: An ASPX backdoor named Zh0uSh311 was located on live servers as well as recovered fro a staging server.

An ASPX backdoor named Zh0uSh311

live servers

a staging server

was located

recovered

on

fro


Input: This backdoor does not require authentication, and its use appears to be straightforward.


Input: Its functionality breaks down into three fairly standard components: SQL queries, executing commands, and uploading files.

Its functionality

SQL queries

executing commands

uploading files

breaks down

into


Input: This organization utilized backdoors which masqueraded as varying versions of Notepad.

This organization

backdoors

varying versions of Notepad

utilized

masqueraded

as


Input: They replace the existing Notepad.exe on the infected machine, and when run they call out to a remote server and execute any shell code returned by the remote server.

they

a remote server

any shell code returned by the remote server

call out

execute

to


Input: There will be a detailed analysis of these backdoors posted to Cylance's blog in the future.


Input: PVZ is a name for a set of executables used together to create a botnet.


Input: The name PVZ was assigned by us as this is one of the few tools this organization has not named themselves.


Input: The components are as follows: XYNTService was not developed by the Cleaver team, but instead is a publicly available project which executes an executable as a service.

a publicly available project

an executable

a service

executes

as


Input: The purpose of PVZ-In is to communicate with a command and control server.

PVZ-In

a command and control server

communicate

with


Input: Communication is primarily unidirectional, as little information is provided from the bot to its command and control server.


Input: The known command and control server is located at http: //kundenpflege. menrad (dot) de/js/jquery/default.aspx and the command and control protocol only uses HTTP.

The known command and control server

http: //kundenpflege. menrad (dot) de/js/jquery/default.aspx

the command and control protocol

HTTP

is located

uses

at


Input: The commands as well as infected computer information are transferred in the Content- Disposition HTTP header, making the traffic easy to pass over as benign.

The commands as well as infected computer information

the Content- Disposition HTTP header

the traffic

benign

are transferred

pass over

in

as


Input: When a command is received from the server, the results are stored in a central location on disk that the PVZ tools utilize.

a command

the server

the results

a central location on disk that the PVZ tools utilize

is received

are stored

from

in


Input: Command functionality is limited to executing supplied commands, downloading and executing executables as well as self-updating.

Command functionality

executing supplied commands

downloading

executing executables

self-updating

is limited

to


Input: The debug file path for PVZ-In is: PVZ-In has been observed using the file name ossisvc.exe.


Input: PVZ-Out is the other half of the command and control channel, primarily uploading results of commands and keystroke logging data to a remote server.

PVZ-Out

the other half of the command and control channel

results of commands and keystroke logging data

a remote server

is

uploading

to


Input: The known command and control server for PVZ-Out is located at http: //www.gesunddurchsjahr (dot) de/tor/default.aspx.

The known command and control server for PVZ-Out

http: //www.gesunddurchsjahr (dot) de/tor/default.aspx

is located

at


Input: Much like PVZ-In, this command and control channel communicates with the Content-Disposition HTTP header, but for file data, POST data is supplied.

this command and control channel

the Content-Disposition HTTP header

file data

POST data

communicates

is supplied

with

for


Input: Data uploaded is often compressed, which can make it more difficult to detect the exfiltration of sensitive information.

Data uploaded

it

more difficult to detect the exfiltration of sensitive information

is often compressed

make


Input: The debug file path for PVZ-Out is: PVZ-Out has been observed with the file name osppsvc.exe.


Input: SYN Flooder is a simple network based denial of service tool.

SYN Flooder

a simple network based denial of service tool

is


Input: It is a command line utility capable of being invoked by PVZ-In.

a command line utility

PVZ-In

being invoked


Input: Targeting information is supplied via command line parameters.


Input: The debug file path for SYN Flooder is: SYN Flooder has been observed using the name ossysvc.exe.


Input: Logger Module observes the user's actions and records them to a file.

Logger Module

the user's actions

them

a file

observes

records

to


Input: The recorded actions include mouse clicks, active windows, keypresses, as well as clipboard data.

The recorded actions

mouse clicks

active windows

keypresses

clipboard data

include


Input: The resulting log is written out to a location where PVZ-Out can exfiltrate it to its command and control server.

The resulting log

PVZ-Out

it

its command and control server

is written out

exfiltrate

to


Input: Logger Module has been observed using the name ospcsvc.exe.


Input: The following command and control servers for Logger Module have been observed: WndTest is the evolution of the PVZ tool chain into a single executable.

The following command and control servers for Logger Module

been observed


Input: The tool chain is minimized down to a command and control communications, keystroke logging, and clipboard monitoring.

The tool chain

a command and control communications

keystroke logging

clipboard monitoring

is minimized down

to


Input: The command and control still supports upgrading, downloading, and executing of applications, as well as executing batch scripts.

The command and control

applications

batch scripts

upgrading

downloading

executing

executing


Input: WndTest installs as a service and has been observed attempting to impersonate Adobe Report Service.

WndTest

a service

Adobe Report Service

installs

impersonate

as


Input: WndTest starts using PHP servers for its command and control server, some of which are listed as defaced sites.

WndTest

PHP servers

its command and control server

using

for


Input: We have seen wndTest communicate with the following servers: Csext is a backdoor application developed in C #which runs as a service.

wndTest

the following servers

Csext

a backdoor application developed in C #

a service

communicate

is

runs

with

as


Input: Its primary functionality is based on commands supplied by its configuration file.


Input: The configuration file is able to store specific commands, which are intended to run at particular times.


Input: A recovered configuration is as follows: This configuration executes zhCat to connect back to srv01.microsoftwindowsupdate (dot) net (a deceptive domain owned by this group with falsified Whois data attributing to Microsoft Investor Relations) with XORed communication using the HTTP protocol on TCP port 443.

This configuration

zhCat

srv01.microsoftwindowsupdate (dot) net (a deceptive domain owned by this group with falsified Whois data attributing to Microsoft Investor Relations)

XORed communication

the HTTP protocol

TCP port 443

executes

connect

back to

with

using

on


Input: This zhCat instance is running cmd.exe, effectively making it a reverse connecting shell.

This zhCat instance

cmd.exe

it

a reverse connecting shell

is running

making


Input: This command runs at 00:29 in the morning, and is killed by taskkill at 00:35.

This command

taskkill

is killed

at


Input: This gives the attackers a predictable method to regain access to a compromised network if they ever lose access.

the attackers

access to a compromised network

they ever lose access

regain

if


Input: Csext also has email functionality similar to TinyZBot.

Csext

email functionality similar to TinyZBot

has


Input: This email functionality is used to exfiltrate the results of commands from the command file which can also include requests like gathering user information.

This email functionality

the results of commands from the command file which can also include requests like gathering user information

exfiltrate


Input: We have seen Csext configured to communicate with the following servers: If after reviewing the Indicators of Compromise (IOC) listed in Appendix A, you believe your organization to be a victim of Operation Cleaver, we recommend you consider the following course of action: 1.

Csext

the following servers

communicate

with


Input: If inside the United States, contact the Federal Bureau of Investigation (FBI) via either your local FBI team or FBI CYWATCH at 1-855-292-3937 or cywatch @ic.fbi.gov.


Input: If outside the United States, contact your local, district, state or federal law enforcement authorities.


Input: If you have visibility into the attacks on your company and the tools and expertise to track them down, leverage the IOCs in Appendix A to identify their presence in your network, prevent them from expanding the scope of the compromise, and remove their access immediately.


Input: If you do NOT have visibility into the attacks, need help identifying an existing successful compromise in your organization, or more importantly wish to prevent this attack or attacks similar to Operation Cleaver, please contact your security provider.


Input: If you wish to contact Cylance for additional details not available in this report, please email opcleaver @cylance.com.


Input: If you would like to learn more about Cylance products and professional services, or discuss how Cylance can mitigate Operation Cleaver's impact to your organization, please contact us directly.


Input: Iran in 2014 can probably be best described as galvanizing.


Input: They have long been an'' enemy'' of the west, and the United States in particular, but today's headlines include a variety of topics from nuclear talks to human rights to terrorism to cyber hacking.


Input: Iran continues to be extremely active on the global stage–and thereby on the radar of every superpower.


Input: Iran's cyber sophistication has grown rapidly since the dawn of Stuxnet and they have used hard dollars combined with national pride to help build their cyber army.


Input: Few doubt their commitment as a government and nation state to funding and recruiting cyber warriors to infiltrate and damage their enemies.


Input: And it has been commonly postulated that almost all activity since 2010 coming out of Iran is associated with retaliation for Stuxnet/Duqu/Flame, which seems natural given the severity of the impact.


Input: But they don't need Stuxnet as motivation to want to hack the world.


Input: They have long desired power on the political stage, in particular in the fight for nuclear power autonomy.


Input: With the deadlines around the Iranian nuclear discussions pushed to 2015, the attacks may be tied to negotiating power when discussing a pact with the nuclear superpowers of United States, Britain, France, Germany, Russia and China.


Input: The inner workings of the Iranian government remain largely a mystery to the western world.


Input: However, Iran's control over its people and the private businesses birthed inside has been well reported.


Input: In a 2014 Reuters article, the reporters detail how the secret Iranian organization called'' Setad Ejraiye Farmane Hazrate Emam'' has become one of the most powerful organizations in the country, capable of taking over properties and businesses, buying controlling interests in numerous sectors including finance, oil, telecommunications and many others totaling in upwards of $95B.


Input: Even the US Treasury has documented an extensive fronting of companies in its report of Execution of Imam Khomeini's Order (EIKO), which through its two main subsidiaries controls 37 private businesses that are purely front companies for the Iranian government.


Input: The history of Iran controlling the usage of the Internet and the very Internet on-ramps into Iran is well known,.


Input: They have controlled much of the country's Internet access to date and have taken over controlling interests in those companies to carry out their work.


Input: Given Operation Cleaver's frequent spin-up and take-down of large IP blocks inside the AFRANET IP space inside Iran, and Iran's well recorded investment in cyber warfare leads us to one simple conclusion: Iran is extremely active in the world of hacking.


Input: Operation Cleaver's intense focus on critical infrastructure companies, especially in South Korea, hints at information sharing or joint operations with Iran's partner, North Korea.


Input: In September, 2012, Iran signed an extensive agreement for technology cooperation agreement with North Korea, which allows for collaboration on a variety of efforts including IT and security.


Input: Operation Cleaver's carefully selected targets like the oil and gas industry, energy and utility companies, as well as airlines and airports, indicates Iran's desire to gain deep access into the world's most critical environments.


Input: The end goal of this operation is not known at this time.


Input: University student recruitment was hinted at within Operation Cleaver and is consistent with Iran's reported history of active warrior recruitment in the educational space.


Input: Overall, there are many reasons that Iran may be pursuing the targets they did in Operation Cleaver.


Input: While we may never truly know, it is important to consider all the above and more when trying to understand the why.


Input: After tracking the Operation Cleaver team for over two years, we're led to the inexorable conclusion: the government of Iran, and particularly the Islamic Revolutionary Guard Corps (IRGC), is backing numerous groups and front entities to attack the world's critical infrastructure.


Input: As security experts in Critical Infrastructure and Key Resources (CIKR), Industrial Control Systems (ICS), Supervisory Control and Data Acquisition (SCADA) systems, Building Management Systems (BMS), embedded systems and fixed-function systems, we know how easy they are to hack.


Input: We have worked with countless customers and vendors throughout the years to notify them of vulnerabilities, assist with remediatation efforts, and help mitigate threats to their environments.


Input: Unfortunately, many critical infrastructure organizations are unable to secure their complex envirnoments against modern attacks.


Input: They fall victim to the'' glue flu'', a malaise of feeling stuck, not wanting to change the status quo for fear they will find problems that they have no idea how to prevent.


Input: This'' security anaphylaxis'' spells real disaster.


Input: If Operation Cleaver doesn't get the world to wake up to what is happening in the silent world of cyber, then perhaps nothing will.


Input: Prevention is everything and we should never give up until it's achieved.


Input: Challenge your trusted advisors.