MURKYTOUR Backdoor

In October 2024, a threat actor aligned with Iran, UNC2428, launched a cyber espionage campaign targeting Israeli individuals. Masquerading as recruiters from the Israeli defense contractor Rafael, the group used a job-themed social engineering scheme to lure victims. Once individuals showed interest, they were redirected to a fraudulent website imitating Rafael, where they were prompted to download an application tool named 'RafaelConnect.exe.'

From Interest to Intrusion: The Malware Delivery Chain

The downloaded tool was actually an installer known as LONEFLEET. It featured a graphical user interface (GUI) designed to look like a legitimate job application portal, requesting personal details and a resume upload. This seemingly harmless interface concealed harmful intent. Upon data submission, a backdoor called MURKYTOUR was deployed silently in the background via a launcher named LEAFPILE, granting attackers ongoing access to the infected system. This approach highlights the threat actors' strategic use of GUIs to disguise malware execution as benign activity.

More than One Player: The Expanding Iranian Cyber Threat Landscape

UNC2428 is just one piece of a broader Iranian cyber operations puzzle. The campaign shares characteristics with activities linked to Black Shadow, an entity accused by the Israel National Cyber Directorate and believed to operate under Iran's Ministry of Intelligence and Security (MOIS). Their targets span numerous sectors in Israel, including:

• Government and defense
• Healthcare and finance
• Technology and communications

Another actor, UNC3313, associated with the MuddyWater group, has run spear-phishing campaigns since 2022 and is known for using legitimate remote monitoring tools to maintain stealth and persistent access. Meanwhile, UNC1549 has moved toward cloud-based infrastructure to better blend into enterprise environments and avoid detection.

Masterminds of Manipulation: APT42 and Beyond

APT42, also known as Charming Kitten, is renowned for its sophisticated social engineering techniques. This group has deployed fake login pages impersonating major platforms like Google, Microsoft and Yahoo! to harvest credentials. They've used platforms like Google Sites and Dropbox to funnel victims to these malicious pages, enhancing their deception.

Moreover, APT34 (OilRig) has utilized custom backdoors such as DODGYLAFFA and SPAREPRIZE in attacks on Iraqi government systems. In total, cybersecurity experts have identified over 20 unique malware families developed or used by Iranian actors across various Middle Eastern cyber operations in 2024.

Conclusion: A Persistent and Evolving Threat

Iranian cyber actors have shown a notable evolution in tactics, combining psychological manipulation with technical sophistication. Through GUIs, legitimate tools, and cloud services, they are refining their approach to maintaining access and evading detection, signaling a continuing challenge for regional and global cybersecurity efforts.