A recent report unveiled a cyber espionage campaign orchestrated by Iranian hackers, deploying an innovative malware named “Menorah” against their targets.

The cyber group, known as APT34 and by other names like OilRig, Cobalt Gypsy, IRN2, and Helix Kitten, operates out of Iran. Their cyber activities, targeting various Middle Eastern nations, have been traced back to 2014. Their primary targets seem to be government agencies and corporations operating in finance, energy, chemicals, and telecom industries.

According to research from Trend Micro, the group’s latest endeavor, starting in August, involved dispatching phishing emails to recipients in Saudi Arabia. These emails contained the Menorah malware, a sophisticated tool tailored for cyber espionage. This malware allows the hacker to upload specific files, initiate shell commands, and download files onto the affected system.

Notably, similarities were found between Menorah and the previously employed SideTwist backdoor by APT34. However, the former demonstrates enhanced capabilities and presents a heightened challenge for detection.

Researchers noted, “APT34 constantly refines its tactics, experimenting with various strategies and techniques.”

Limited data was retrieved about APT34’s recent targets during Trend Micro’s assessment. However, the phishing strategy involved a counterfeit file registration form linked to the Seychelles Licensing Authority, which had pricing details in Saudi Arabian currency. The primary targets were potentially situated in Saudi Arabia.

Historically, APT34 has been linked to multiple notable cyber assaults on different Middle Eastern targets. In the past, they’ve targeted an official from Jordan’s foreign ministry and carried out attacks on multiple Middle Eastern banks.

Considering their intricate operations and seemingly extensive resources, Trend Micro researchers warn, “APT34 represents a formidable cybersecurity threat not just in the region, but potentially on a broader scale.”

And, it’s on its way here as well.