Operation Saffron RoseThere is evolution and development underway within Iranian-based
hacker groups that coincides with Iran’s efforts at controlling
political dissent and expanding offensive cyber capabilities. The
capabilities of threat actors operating from Iran have traditionally
been considered limited and have focused on politically motivated
website defacement and DDoS attacks.
Our team has href="/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-operation-saffron-rose.pdf"
target="_blank">published a report that documents the activities
of an Iran-based group, known as the Ajax Security Team, which
has been targeting both US defense companies as well as those in Iran
who are using popular anti-censorship tools to bypass Internet
censorship controls in the country.
This group, which has its roots in popular Iranian hacker forums
such as Ashiyane and Shabgard, has engaged in website
defacements since 2010. However, by 2014, this group had transitioned
to malware-based espionage, using a methodology consistent with other
advanced persistent threats in this region.
It is unclear if the Ajax Security Team operates in isolation or if
they are a part of a larger coordinated effort. We have observed this
group leverage varied social engineering tactics as a means to lure
their targets into infecting themselves with malware. They use malware
tools that do not appear to be publicly available. Although we have
not observed the use of exploits as a means to infect victims, members
of the Ajax Security Team have previously used exploit code in web
site defacement operations.
The objectives of this group are consistent with Iran’s efforts at
controlling political dissent and expanding offensive cyber
capabilities, but we believe that members of the group may also be
dabbling in traditional cybercrime. This indicates that there is a
considerable grey area between the cyber espionage capabilities of
Iran’s hacker groups and any direct Iranian government or military involvement.
Although the Ajax Security Team’s capabilities remain unclear, we
believe that their current operations have been somewhat successful.
We assess that if these actors continue the current pace of their
operations they will improve their capabilities in the mid-term.
href="/content/dam/legacy/resources/pdfs/fireeye-operation-saffron-rose.pdf">View
a full version of the report on "Operation Saffron
Rose".
Source:
Operation Saffron Rose
