Iran-Linked Hackers Destroy IT, Backups, and Recovery Systems in Cyberattack targeting Middle East

Summary

A cyber attack attributed to the Iranian threat group APT39 (also known as Charming Kitten) has resulted in significant damage to IT infrastructure, backups, and recovery systems across multiple organizations in the Middle East. The attackers used a malware called "FileFiend" to exfiltrate data and destroy critical files on compromised machines.

Key Points

1. Threat Actor: APT39 (Charming Kitten), an Iranian threat group.
2. Targeted Organizations: Multiple organizations across the Middle East, including those in Jordan, Lebanon, and Saudi Arabia.
3. Malware Used: "FileFiend," a custom-built malware that can exfiltrate data and destroy files on compromised machines.
4. Attack Vectors:
   • Initial compromise through phishing emails or social engineering tactics.
   • Use of proxychains for RDP access and download tunneling.
5. Impact:
   • Destruction of IT infrastructure, backups, and recovery systems.
   • Data exfiltration from compromised networks.

Technical Details

• FileFiend: A custom malware that masquerades as a legitimate file exchange tool (Exchangedb.exe). It is designed to exfiltr

Read the full article at Cyber Security News

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.