This report is based on proprietary Recorded Future network traffic analysis of RAT controllers detected using signatures developed by Insikt Group researchers. The period of analysis covers November 28, 2019 through January 5, 2020.​​ 

This report will primarily be of interest to SOC analysts and threat intelligence professionals in organizations operating in the energy sector who are conducting threat hunting assignments relating to malware used by Iranian nation-state threat actors.​​ 

Over the course of the last year, Recorded Future research has demonstrated that Iran-nexus groups, possibly including APT33 (also called Elfin), have been prolific in amassing operational network infrastructure throughout 2019. Additionally, in November 2019, Microsoft disclosed that APT33 had shifted focus from targeting IT networks to physical control systems used in electric utilities, manufacturing, and oil refineries. We also documented state-sponsored Iran-nexus groups making heavy use of freely available commodity malware for active network intrusions. These tools are usually intended to be used for defensive red-teaming exercises. One such tool used by several Iran-nexus groups is PupyRAT.​​ 

Using Recorded Future remote access trojan (RAT) controller detections and network traffic analysis techniques, Insikt Group identified a PupyRAT command and control (C2) server communicating with a mail server for a European energy sector organization from late November 2019 until at least January 5, 2020. While metadata alone does not confirm a compromise, we assess that the high volume and repeated communications from the targeted mail server to a PupyRAT C2 are sufficient to indicate a likely intrusion.​​ 

PupyRAT es un RAT de código abierto disponible en Github y, según el desarrollador, es una "herramienta RAT multiplataforma, multifunción y post-explotación, escrita principalmente en Python." Anteriormente fue empleado por grupos iraníes APT33 (Elfin, Magic Hound, HOLMIUM) y COBALT GYPSY (que se solapa con APT34/OilRig).​​ 

Although this commodity RAT, PupyRAT, is known to have been used by Iranian threat actor groups APT33 and COBALT GYPSY, we cannot confirm whether the PupyRAT controller we identified is used by either Iranian group. Whoever the attacker is, the targeting of a mail server at a high-value critical infrastructure organization could give an adversary access to sensitive information on energy allocation and resourcing in Europe.​​ 

El objetivo de una organización clave en el sector energético europeo es de particular interés dado su papel en la coordinación de los recursos energéticos europeos. Grupos iraníes (y otros) atacaron una amplia variedad de industrias en EE. UU. y Europa, con reportes recientes que indican un aumento en la segmentación de software de control industrial del sector energético.​​ 

We emphasize that this activity predates the recent escalation of kinetic activity between the U.S. and Iran, and therefore likely relates to espionage-motivated intrusion activity or the prepositioning of network access within a high-value network in the European energy sector.​​ 

To defend against commodity RATs such as PupyRAT and others, Recorded Future recommends that organizations:​​ 

• Monitor for sequential login attempts from the same IP against different accounts. This type of activity is more difficult to detect than traditional brute forcing, but will help insulate organizations from a favored tactic of cyber operators.​​ 
• Introduce multi-factor authentication. This has proven to be a highly effective mitigation practice for many organizations that have historically experienced a high level of credential stuffing and password-spraying attacks.​​ 
• Use a password manager and set a unique strong password for each online account.​​ 
• Analyze and cross-reference log data. This may help to detect incidents involving high-frequency lockouts, unsanctioned remote access attempts, temporal attack overlaps across multiple user accounts, and fingerprint unique web browser agent information.​​