Pierluigi Paganini April 19, 2023

An Iran-linked APT group tracked as Mint Sandstorm is behind a string of attacks aimed at US critical infrastructure between late 2021 to mid-2022.

Microsoft has linked the Iranian Mint Sandstorm APT (previously tracked by Microsoft as PHOSPHORUS) to a series of attacks aimed at US critical infrastructure between late 2021 to mid-2022.

The IT giant reported Mint Sandstorm is refining its tactics, techniques, and procedures (TTPs). The group rapidly weaponized N-day vulnerabilities in popular enterprise applications by using publicly disclosed POCs. Mint Sandstorm also used custom tools in selected targets, notably organizations in the energy and transportation sectors.

Mint Sandstorm targets both private and public organizations, including political dissidents, journalists, activists, the Defense Industrial Base (DIB), and employees from multiple government agencies, including individuals protesting oppressive regimes in the Middle East.  The activity associated with the Mint Sandstorm group overlaps with public reporting on groups known as APT35, APT42, Charming Kitten, and TA453.

“Microsoft assesses that Mint Sandstorm is associated with an intelligence arm of Iran’s military, the Islamic Revolutionary Guard Corps (IRGC), an assessment that has been corroborated by multiple credible sources including Mandiant, Proofpoint, and SecureWorks.” reads the report published by Microsoft. “In 2022, the US Department of Treasury sanctioned elements of Mint Sandstorm for past cyberattacks citing sponsorship from the IRGC.”

Microsoft states that from late 2021 to mid-2022, the Mint Sandstorm subgroup launched a series of attacks against US critical infrastructure, including seaports, energy companies, transit systems, and a major US utility and gas entity. The attacks were conducted as a retaliatory against destructive cyberattacks that hit the national railway system, maritime traffic at a major Iranian seaport, and gas station payment systems in the country.

Once gained initial access to an organization, the threat actors deploy a custom PowerShell script to gather intelligence on the target. In case the victim meet the targeting requirements the group adopted two possible attack chains:

• Attack chain 1: The group uses Impacket for lateral movement and relies extensively on PowerShell scripts (rather than custom implants) to enumerate admin accounts and enable RDP connections. The group uses an SSH tunnel for C2 and manages to steal the Active Directory database to access credentials for users’ accounts.
• Attack chain 2: The subgroup uses Impacket for lateral movement, then relies on webhook.site for C2 and creates scheduled tasks to maintain persistence. In the last stage of the attack, the subgroup deploys a custom malware variant, such as Drokbk or Soldier instead of using publicly available tools and simple scripts. 

Microsoft also observed The Iran-linked APT group using another attack chain involving low-volume phishing campaigns and a different custom implant.

“Capabilities observed in intrusions attributed to this Mint Sandstorm subgroup are concerning as they allow operators to conceal C2 communication, persist in a compromised system, and deploy a range of post-compromise tools with varying capabilities.” concludes Microsoft. “A successful intrusion creates liabilities and may harm an organization’s reputation, especially those responsible for delivering services to others such as critical infrastructure providers, which Mint Sandstorm has targeted in the past.  

Please vote for Security Affairs (https://securityaffairs.com/) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections:

• The Teacher – Most Educational Blog
• The Entertainer – Most Entertaining Blog
• The Tech Whizz – Best Technical Blog
• Best Social Media Account to Follow (@securityaffairs)

Please nominate Security Affairs as your favorite blog.

Nominate here: https://docs.google.com/forms/d/e/1FAIpQLSfaFMkrMlrLhOBsRPKdv56Y4HgC88Bcji4V7OCxCm_OmyPoLw/viewform

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Iran)