Iranian Hackers Use New PowerExchange Malware Against UAE

APT34, which is claimed to be supported by Iran, has attacked government institutions of the United Arab Emirates using the PowerExchange malware.

In cyber attacks organized by Iranian hackers, PowerExchange was used to open backdoors on Microsoft Exchange servers located in the targets’ companies. Hackers also deployed a web shell called ExchangeLeech that can steal users’ credentials after infiltrating respective Exchange servers via a phishing email containing an archived malicious executable.

The FortiGuard Labs research team said they found the PowerExchange backdoor in compromised systems of a government agency in the United Arab Emirates. The malware communicates with the command and control (C2) server using e-mails sent using the Exchange Web Services (EWS) API, and thus exposes the stolen information to attackers. sending.

Security researchers said that since the target Exchange server itself is used for command-and-control purposes, all backdoor traffic appears to be benign, thus avoiding virtually any network-based detection technology.

The most obvious one among the backdoor’s capabilities is that hackers can execute code on systems and steal files they want. FortiGuard Labs said the attack was linked to APT34, based on the similarities between PowerExchange and the TriFive malware that Iranian hackers had previously used to target Kuwait.