EXECUTIVE SUMMARY
A cyber espionage group, Earth Simnavaz, also known as APT34 or OilRig, has been actively targeting governmental and critical infrastructure entities in the Middle East, particularly in the Gulf region. The group, believed to be linked to Iranian interests, is focused on compromising key infrastructure, exploiting vulnerabilities, and establishing long-term persistence in compromised systems. Campaigns demonstrate a significant rise in activity, with Earth Simnavaz deploying advanced tactics, including the use of STEALHOOK, a tool designed to retrieve and exfiltrate sensitive credentials from compromised systems. Additionally, the group has been exploiting CVE-2024-30088, a Windows Kernel privilege escalation vulnerability, to further infiltrate organizations, steal critical information, and facilitate further cyberattacks on additional targets.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY
A cyber espionage group, Earth Simnavaz, also known as APT34 or OilRig, has been actively targeting governmental and critical infrastructure entities in the Middle East, particularly in the Gulf region. The group, believed to be linked to Iranian interests, is focused on compromising key infrastructure, exploiting vulnerabilities, and establishing long-term persistence in compromised systems. Campaigns demonstrate a significant rise in activity, with Earth Simnavaz deploying advanced tactics, including the use of STEALHOOK, a tool designed to retrieve and exfiltrate sensitive credentials from compromised systems. Additionally, the group has been exploiting CVE-2024-30088, a Windows Kernel privilege escalation vulnerability, to further infiltrate organizations, steal critical information, and facilitate further cyberattacks on additional targets.[emaillocker id="1283"]
Earth Simnavaz employs advanced techniques, including the deployment of a backdoor on Microsoft Exchange servers for credential theft and the exploitation of vulnerabilities like CVE-2024-30088 for privilege escalation. A key tool in their arsenal is "StealHook," which exfiltrates credentials by leveraging compromised Exchange servers to send stolen data, including passwords, to attacker-controlled email accounts. The group uses customized .NET tools, PowerShell scripts, IIS-based malware, and ngrok remote monitoring tools to maintain stealth. Their attack chain typically begins with a web shell uploaded to a vulnerable web server, allowing the execution of malicious commands, and facilitating lateral movement within the targeted network. Password filter DLLs are used to intercept plaintext passwords, which are then exfiltrated through legitimate email traffic.
Earth Simnavaz's persistent targeting of government sectors and critical infrastructure in the Middle East poses a significant threat. Their use of tools like StealHook and the exploitation of CVE-2024-30088 in their attack chain demonstrates their capability to remain undetected while exfiltrating sensitive data. It is crucial to prioritize advanced security measures, including Zero Trust architectures and enhanced monitoring systems, to mitigate the risks posed by such state-sponsored actors. Intelligence-driven responses and strong incident response frameworks are essential in combating these cyberattacks.
THREAT PROFILE:
| Tactic | Technique Id | Technique |
| Initial Access | T1190 | Exploit Public-Facing Application |
| Execution | T1059 | Command and Scripting Interpreter |
| T1053 | Scheduled Task/Job | |
| T1047 | Windows Management Instrumentation | |
| Privilege Escalation | T1068 | Exploitation for Privilege Escalation |
| Defense Evasion | T1027 | Obfuscated Files or Information |
| T1140 | Deobfuscate/Decode Files or Information | |
| Credential Access | T1003 | OS Credential Dumping |
| Lateral Movement | T1021 | Remote Services |
| Collection | T1056 | Input Capture |
| T1114 | Email Collection | |
| Command and Control | T1071 | Application Layer Protocol |
| T1105 | Ingress Tool Transfer | |
| Exfiltration | T1041 | Exfiltration Over C2 Channel |
| T1567 | Exfiltration Over Web Service |
RECOMMENDATION:
We strongly recommend applying an update for Windows Kernel Elevation of Privilege Vulnerability
• Download here: https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-30088
REFERENCES:
The following reports contain further technical details:
https://www.bleepingcomputer.com/news/security/oilrig-hackers-now-exploit-windows-flaw-to-elevate-privileges/