![Dark Reading Global Logo Dark Reading Global Logo](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc8a6395802cafad0/654e0d60123f32040a075bab/Dark_Reading_Logo_Global_k.png?width=700&auto=webp&quality=80&disable=upscale)
Breaking cybersecurity news, news analysis, commentary, and other content from around the world, with an initial focus on the Middle East & Africa.
Iran-Linked APT34 Spy Campaign Targets Saudis
The Menorah malware can upload and download files, as well as execute shell commands.
![Burning hanukkah candles in a menorah on black background Burning hanukkah candles in a menorah on black background](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt9cfe83514a79b0f2/654e3a0d450440040a620b7f/menorah-Zee-Alamy.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
A phishing campaign which drops cyber espionage malware is taking aim at users in the Middle East.
The campaign is mounted by the infamous advanced persistent threat known as APT34 (aka OilRig, Helix Kitten, Cobalt Gypsy), and employs a custom tool that researchers have dubbed "Menorah." This malware is capable of identifying the target's machine, reading and uploading files from the machine, and downloading other files or malware.
According to research by Trend Micro, the document used in the attack contains pricing information in Saudi Riyal, which could indicate at least one targeted victim is inside Saudi Arabia.
Linked to Iran, APT34 typically focuses on collecting sensitive intelligence, and has been involved in high-profile cyberattacks against a diverse range of targets in the Middle East, including government agencies, critical infrastructure, telecommunications, and key regional entities.
Trend Micro's researchers said that a changing of tactics and tools is typical of APT groups and demonstrates their resources and varied skills. Being able to create new pieces of malware and tools allows such groups to continuously deploy new techniques "to ensure success in intrusions, stealth, and cyberespionage."
Read more about:
DR Global Middle East & AfricaAbout the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024