Thread by @juanandres_gs

Ok friends, you know it's a wonderful day when you get woken up by @Bing_Chris on madness in Iran. If you haven't seen what's going on, another trollish attack played out today with gas stations in Iran not being able to dispense gas #64411

https://twitter.com/IranIntl_En/status/1452944995741315079?s=20

Screens on the gas pump PoS systems say 'cyberattack, 64411' in Farsi. For avid readers, this should be a throwback to the Iranian railway systems attack in July where the attackers also directed calls to 64411, the Office of Iran's Supreme Leader, Ali Khamenei' #MeteorExpress

We were able to reconstruct the attack chain used in the Iranian railway system, a combination of well-written crafty batch scripts + an externally configurable wiper called 'Meteor'. That led us to calling this group MeteorExpress.
s1.ai/meteor

Pivoting off of our findings, folks at Checkpoint found a couple of earlier variants of Meteor codenamed Stardust and Comet. These 2019 samples were used for attacks in Syrian organizations with an Iranian (IRGC) nexus – Alfadelex, Cham Wings Airlines, Afrada, and Katerji.

What's interesting about the Stardust and Comet variants, as @megabeets_ pointed out, is that they contain a reference to 'Indra'. This was the name of a 'hacktivist' group that claimed responsibility for the Syrian attacks on twitter and facebook. It went dark in Oct 2020.

We researchers clearly injected ourselves into an awkward part of MeteorExpress' attacks. The Syrian attacks (Stardust/Comet) were under a given hacktivist persona. Then that persona is shutdown, Indra references are cleaned from the code, and a new campaign begins.

The new campaign under the 'Meteor' variant isn't immediately claimed but it coincides with spastic appearance of multiple new 'hacktivist' groups ((A|E)dalat Ali and Gonjeshk(|e) Darande, accounting for multiple spellings) and multiple high profile hacks.

The most notorious among them is that of Evin prison, a truly horrible place. The attackers (under the Adalat Ali persona) leaked footage of abuse of prisoners as well as the reaction of the camera operators as their malware disables the system.

https://twitter.com/IranIntl_En/status/1431606816287383559?s=20

We don't yet have samples specifically related to Evin prison. The best we can say is that the functionality shown in the videos matches that of the Meteor wiper (which includes screen locker with a custom image, MBR corruptor, and configurable file wiper).

These attacks are a lightning rod of infosec hottake fodder (ICS attacks + wipers). Thankfully @HostileSpectrum took on the analysis with the appropriate nuance to keep us at bay. Restraint is something the operative metric we should pay attention to here.
offensivecyber.org/2021/09/23/bal…

This latest attack not only includes the gas pumps but also electronic billboards with questions like– 'Khamenei! Where is our gas?' and 'Free gas in Jamaran gas station' as reported by AP @jongambrellAP
abcnews.go.com/International/…

Some immediately jumped to the conclusion that this is Israel paying Iran back for recent spats. I wouldn't jump to that conclusion. The idea that this is legitimate hacktivism is hard to swallow–mostly due to the targeting and style of operations + quality of batch scripts.

While I also don't think that the U.S. is involved in this, reporting has glossed over the fact that the wipers are rife with debug strings that are all written in *perfect English*. If you're familiar with threat research, you should recognize that as a noteworthy anomaly.

Given now more widespread revelations of the diversity of threat actors in the region and their propensity for acquiring foreign tooling (the UAE/DarkMatter situ being an obvious example), we'd be remiss to jump to attributory conclusions (Saudis? Jordanians?Emiratis?... etc)

Finally, it's important to add another layer of concern with how the 'hacktivist' fronts are now actively courting journalists, with the latest Gonjeshke Darand account tagging prominent journos in cyber. (Note that this is their second twitter account and possibly a copycat.)

Now that we are all on the same page, this is where the fun starts. Time to do some hunting. Will update with any findings. #HappyHunting #VTday