Cyber Threat

Iranian State Hackers Unleash Stealthy WezRat Malware Against Israel

ClickControl

Author

December 04, 2024

Published

Reading

Iranian State Hackers Unleash Stealthy WezRat Malware Against Israel

Iranian State-Sponsored Malware “WezRat” Discovered

Security researchers at Check Point have identified a sophisticated new malware called WezRat, attributed to the Iranian hacking group Cotton Sandstorm (also known as Emennet Pasargad or Aria Sepehr Ayandehsazan).

Key Features of WezRat:

– Remote command execution

– Screenshot capture

– File upload/download capabilities

– Keylogging

– Clipboard and cookie theft

– Modular design using separate DLL files

Distribution Method:

The malware is primarily distributed through phishing emails, disguised as Google Chrome security updates. In October 2024, Israeli organizations were targeted through emails impersonating the Israeli National Cyber Directorate.

Technical Details:

– Uses trojanized Google Chrome installers

– Deploys “Updater.exe” alongside legitimate Chrome installation

– Communicates with command-and-control servers

– Requires specific password parameters for execution

– Features evolving capabilities since its September 2023 detection

Security Impact:

WezRat poses a significant cyber espionage threat to organizations across:

– United States

– Europe

– Middle East

The malware’s ongoing development and sophisticated features indicate a well-resourced operation with at least two separate teams handling development and operations, demonstrating Iran’s continued investment in cyber warfare capabilities.

Keywords: WezRat malware, Iranian cyber threats, Cotton Sandstorm hacking group, Emennet Pasargad, Aria Sepehr Ayandehsazan, state-sponsored malware, cyber espionage, remote command execution, keylogging, clipboard theft, cookie theft, phishing attacks, Google Chrome security updates, Israeli National Cyber Directorate, trojanized installers, command-and-control servers, cyber warfare, Iranian hackers, malware detection, cyber security threats, Check Point research, Middle East cybersecurity, US cyber threats, European cyber security, malware distribution methods, DLL-based malware, modular malware, cyber threat intelligence, advanced persistent threats, APT groups, information theft malware

Share This Article