New spyware targets data on Telegram and Psiphon VPN

New spyware targets data on Telegram and Psiphon VPN

Threat actors with suspected ties to Iran have been found to leverage instant messaging and VPN apps like Telegram and Psiphon to install a Windows remote access trojan (RAT) capable of stealing sensitive information from targets’ devices since at least 2015.

Russian cybersecurity firm Kaspersky, which pieced together the activity, attributed the campaign to an advanced persistent threat (APT) group it tracks as Ferocious Kitten, a group that has singled out Persian-speaking individuals allegedly based in the country while successfully operating under the radar.

“The targeting of Psiphon and Telegram, both of which are quite popular services in Iran, underlines the fact that the payloads were developed with the purpose of targeting Iranian users in mind,” Kaspersky’s Global Research and Analysis Team (GReAT) said.

“Moreover, the decoy content displayed by the malicious files often made use of political themes and involved images or videos of resistance bases or strikes against the Iranian regime, suggesting the attack is aimed at potential supporters of such movements within the country.”

Kaspersky’s findings emerge from two weaponized documents that were uploaded to VirusTotal in July 2020 and March 2021 that come embedded with macros, which, when enabled, drop next-stage payloads to deploy a new implant called MarkiRat.

The backdoor allows adversaries broad access to a victim’s personal data, comprising features to record keystrokes, capture clipboard content, download and upload files, as well as the ability to execute arbitrary commands on the victim machine.

“Ferocious Kitten is an example of an actor that operates in a wider ecosystem intended to track individuals in Iran,” the researchers concluded. “Such threat groups do not appear to be covered that often and can therefore get away with casually reusing infrastructure and toolsets without worrying about them being taken down or flagged by security solutions.”

[The Hacker News]


Other posts