TA453 (Charming Kitten) expands its espionage toolkit with new file types and cross‑platform Mac malware, deploying LNK infection chains and a PowerShell backdoor named GorjolEcho. Proofpoint and partners disrupted the operation, but TA453 continues targeting nuclear-security experts amid JCPOA negotiations, using multi‑cloud hosting and impersonation to advance its objectives. #TA453 #CharmingKitten #GorjolEcho #NokNok #IRGC #IRGC_IO
Keypoints
- TA453 adapts its malware arsenal, including Mac-targeting malware, and experiments with new file types.
- In May 2023 TA453 began deploying LNK infection chains instead of Microsoft Word macros.
- The group aims for intrusive, unauthorized reconnaissance across targeted individuals and organizations.
- Proofpoint and partners disrupted TA453 efforts, including actions against Dropbox-hosted infrastructure.
- TA453 uses benign messages and multi‑persona impersonation to approach nuclear-security experts in the Middle East.
- The campaign leverages multi‑cloud delivery (Google Scripts, Dropbox, CleverApps) and modular backdoors (GorjolEcho, NokNok) to establish footholds.
MITRE Techniques
- [T1566.002] Spearphishing Link – Initial contact via a benign email that delivered a malicious Google Script link redirecting to a Dropbox host. – “delivered a malicious link to a Google Script macro that would redirect the target to a Dropbox URL.”
- [T1059.001] PowerShell – The LNK in the RAR used PowerShell to download additional stages from a cloud hosting provider. – “LNK enclosed in the RAR used PowerShell to download additional stages from a cloud hosting provider.”
- [T1105] Ingress Tool Transfer – Downloading additional payloads from cloud hosting during the infection chain. – “download base64 encoded content from a .txt file” ( Borjol/GorjolEcho flow).
- [T1027] Obfuscated/Compressed Files and Information – Obfuscated PowerShell to call out to the cloud hosting provider. – “obfuscated PowerShell to call out to the cloud hosting provider.”
- [T1132] Data Encoding – Exfiltration uses base64 encoding as part of the data pipeline. – “encoded in base64 and then saved to result.txt for exfiltration.”
- [T1518.001] Software Discovery – NokNok information modules gather installed software for exfiltration. – “list installed Applications which are then base64 encoded for exfiltration.”
- [T1082] System Information Discovery – NokNok Informations module retrieves OS version, uptime, installed software. – “to retrieve information about the system’s software, specifically the SPSoftwareDataType … and installed software.”
- [T1016] System Network Configuration Discovery – NokNok Informations/other modules gather network information via ifconfig. – “uses ifconfig to gather network information.”
- [T1057] Process Discovery – NokNok Processes module uses ps -aux to list running processes. – “The Processes module uses ps-aux to gather a list of all currently running processes.”
- [T1547.001] Boot or Logon Autostart Execution – Persistence via a StartUp entry. – “establishes persistence through putting a copy of the initial stages in a StartUp entry.”
- [T1036] Masquerading – Mac/Malware masquerades as legitimate software (RUSI VPN solution and Finder GUI). – “masquerading as a RUSI VPN solution and share drive GUI.”
- [T1059.004] Command and Scripting Interpreter (macOS Bash/AppleScript) – AppleScript and Bash-based macOS infection chain. – “executes an Apple script file, which uses curl to download a file” and “bash script dubbed NokNok.”
- [T1071.001] Web Protocols – GorjolEcho C2 channel uses HTTPS for C2 communications. – “GorjolEcho starts by displaying a decoy PDF … exfiltrating information to the C2 … over AES encrypted HTTPS.”
- [T1041] Exfiltration Over C2 Channel – Collected data is encrypted/encoded and sent to C2. – “exfiltrating information to the C2.”
Indicators of Compromise
- [SHA256] Dropper/Archive – 464c5cd7dd4f32a0893b9fff412b52165855a94d193c08b114858430c26a9f1d, ddead6e794b72af26d23065c463838c385a8fdff9fb1b8940cd2c23c3569e43b
- [SHA256] NokNok Backdoor – 1fb7f1bf97b72379494ea140c42d6ddd53f0a78ce22e9192cfba3bae58251da4
- [SHA256] NokNok Modules – e98afa8550f81196e456c0cd4397120469212e190027e33a1131f602892b5f79
- [SHA256] Persistence NokNok Module – 5dc7e84813f0dae2e72508d178aed241f8508796e59e33da63bd6b481f507026
- [SHA256] Processes NokNok Module – b6916b5980e79a2d20b4c433ad8e5e34fe9683ee61a42b0730effc6f056191eb
- [SHA256] Informations NokNok Module – acfa8a5306b702d610620a07040262538dd59820d5a42cf01fd9094ce5c3487c
- [Host] NokNok C2 – library-store.camdvr.org
- [IP] NokNok C2 – 144.217.129.176
- [Host] Spoofed FTP Server – filemanager.theworkpc.com
- [Host] GorjolEcho C2 – fuschia-rhinestone.cleverapps.io