Skip to content
War-and-conflicts — Industry — Energy — Finance — Protect Your Digital World — Revolutionizing Tech at Cyber Tech Hub — Politics

Iranian Hackers Target Global Orgs with DCHSpy Malware via Fake VPNs

MuddyWater, linked to Iran's MOIS, is using fake VPN apps to spread DCHSpy malware. The spyware can steal contacts, messages, and even WhatsApp data, posing a significant threat to targeted sectors worldwide.

,   and  Administrator
1 min read
In this picture I can see there is a smartphone and there are few specifications mentioned on the...
In this picture I can see there is a smartphone and there are few specifications mentioned on the screen and it is placed in a white box and placed on a brown surface.

Iranian Hackers Target Global Orgs with DCHSpy Malware via Fake VPNs

Iranian state-sponsored hackers, including MuddyWater, are actively targeting global organizations with sophisticated malware campaigns. The latest threat involves the spread of DCHSpy spyware via fake free vpn apps, aiming to steal sensitive data from Android users.

MuddyWater, linked to Iran's Ministry of Intelligence and Security (MOIS), has been deploying new variants of DCHSpy to target English and Farsi-speaking users with anti-regime themes. The group spreads the malware through fake vpn apps shared on Telegram. DCHSpy steals contacts, messages, audio, and WhatsApp data, employing tactics similar to the SandStrike malware.

Researchers at Lookout have tracked 17 malware families from 10 different Iranian APTs over the past decade. MuddyWater, also known as APT34 or 'OilRig', is one of the most active groups, targeting multiple sectors worldwide. These include telecommunications, defense, local government, and oil and natural gas in Asia, Africa, Europe, and North America. The group is known for its complex attacks, aiming at both data theft and system compromise.

Lookout researchers discovered that the hardcoded command and control (C2) IP address in the SandStrike sample was also used multiple times to deploy a PowerShell RAT attributed to MuddyWater. This indicates the group's continuous evolution and adaptation of its tactics.

MuddyWater's latest campaign, involving the spread of DCHSpy spyware via fake vpn apps, highlights the group's ongoing efforts to target global organizations. With the ability to steal sensitive data, including WhatsApp messages, and the addition of file-scanning features in new samples, the threat posed by this Iranian APT is significant. Organizations, particularly in targeted sectors, should enhance their cybersecurity measures to mitigate these evolving threats.

Read also:

Related

Latest