Thread by @_marklech_

[1/n] Earlier today Lab Dookhtegan leaked an interesting document linking the ViceLeaker threat group to a private company in Iran, allegedly operating as a contractor for the government. A thread on the document (Disclaimer: I don't read nor speak Farsi, I do use OCR)

[2/n] I can't corroborate the link between the two, but the attached document is interesting. It describes a malware provided as a product, with features like low performance impact, functional design (?), and support for user and kernel mode, not clear in which OS though.

[3/n] It goes on describing how computer worms work, suggesting that this piece of malware has capabilities to self replicate and propagate independently of a human operator.

[4/n] Some features and modules are described, namely a network share scanner which would be one way to move laterally, but it also indicates physical drive detection and its use as a propagation vector. Could this serve to overcome air gaps or be used for domestic espionage?

[5/n] Other worm like capabilities are implemented in features like the 'Extractor' and 'Binder', which are not very self explanatory, but from what I can tell are probably mechanisms to infect other files and have the malware initiate when they are launched.

[6/n] Other architectural notes specify a 0.2 KB payload used to infect files, thus making the worm "less detectable". Its not clear, but I suppose it means some position independent code is used to divert control from the entry point and fetch a core module from another source

[7/n] Last but not least, this malware has the capability to elevate privileges and run in 'system mode'. Does this mean operating from kernel space? is it in Windows? is a driver involved? is it signed? by whom?

[8/8] This brochure suggests ViceLeaker develops malware for different platforms, yet I'm under the impression that the same subpar standards in OPSEC and technical level remain. I'm waiting for more details by Lab Dookhtegan down the road to see how this story unravels.