On The Trail of An Iranian Hacking Operation

The Iranian Ajax Security Team of hackers went from high-profile hacktivists posturing on Facebook to cyberspies encrypting stolen information from defense contractors.

An Iranian hacktivist group, turned cyber espionage and targeted attack team, made some rookie mistakes along the way in a recently disclosed operation against members of the US defense industry and Iranian dissidents, including a domain name that led researchers to the email address of one of the hackers. But researchers tracking the Iranian hacking operation say they have only scratched the surface of its activities.
Were continuing to investigate them. This is not the whole story. There seems to be a little more to it... [possibly] other things going on in the background, says Adam Meyers, vice president of intelligence at CrowdStrike, which gave the so-called Ajax Security Team the nickname Flying Kitten.
Their spycraft overall is probably not that great, he says. They made some slips along the way, which gave us some visibility into whos tied to it.
CrowdStrike today provided a few more details about the Ajax team, a day after
FireEye published the first report about the Iranian cyberspying operation
. FireEye said the Ajax team waged the so-called Operation Saffron Rose attacks that feature spearphishing emails, and spoofed Microsoft Outlook Web Access and VPN pages, trolling for user credentials from defense contractors and other members of the defense industry. The gang also is targeting Iranian dissidents, luring them with legitimate anti-censorship tools rigged with malware.
CrowdStrike has been watching Irans notoriously loud and high-profile Ajax hacktivist group, best known for defacing websites, all in the name of political activism, this year transform into the new operation focused on targeted attacks.
Meyers says the groups makeover is a common theme hes seen before with APT-type groups. They had gotten the attention of local government by doing nationalist/hacktivist-type attacks, and then theyve become recruited to do some things for a larger body, he says.
The email in the Whois records of the groups malicious domains is
[email protected]
, but CrowdStrike researchers found that those domains initially were registered using the email address
[email protected]
. Keyvan and other Ajax Security Team members until earlier this year had a very public social media presence, with Facebook pages and their own website.
This Internet presence has decreased significantly since early 2014, likely due to a desire to keep a lower profile now that the group is engaged in targeted intrusion activity,
a CrowdStrike blog post
published today said.
CrowdStrike also spotted the Ajax/Flying Kitten hackers combining credential theft and malware: FireEye’s report notes that this adversary’s targeted intrusion activity consists of credential theft and malware delivery individually. The Flying Kitten campaigns investigated by CrowdStrike Intelligence showed that the actor actually combines the two, CrowdStrikes post said.
For example, the adversary will register a domain that spoofs the name of the targeted organization and then host a spoofed login page on that site. The phony login page grabs the victims credentials when he logs in, and then typically redirects him to another web page with a Browser Patch or other download prompt. The downloaded file is the hacker gangs Stealer malware, which siphons data to a remote FTP server.
But Meyers says its unclear whether the Ajax/Flying Kitten hackers are actually behind the malware used in the attacks. Were not 100 percent certain these guys are the ones responsible for the actual malware. They could have been only used to establish the infrastructure.
CrowdStrike is tracking several threat groups operating in Iran that wage targeted attacks, he says
Darien Kindlund, director of threat research at FireEye, says the Ajax Security Team is not the only group of targeted attackers in Iran. What you will likely see over time is they will become more specialized as they proliferate.
CrowdStrike researchers, meanwhile, also spotted a website run by Ajax/Flying Kitten called parmanpower.com, which poses as an Iraqi recruiting, training, and development business. The website does not appear to deliver any malware, so its most likely purpose is to act as a credential-collection mechanism much like the spoofed Institute of Electrical and Electronics Engineers (IEEE) Aerospace Conference website (aeroconf2014[.]org) the adversary used earlier this year. This spoofed recruiting company website could be used to target entities across a wide range of sectors, according to CrowdStrike.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
On The Trail of An Iranian Hacking Operation