Iran-Linked Hackers Expand Targets To African Telecom Companies
Hackers affiliated with Iran's cyber-espionage group, MuddyWater, have extended their focus to target telecommunications companies in Egypt, Sudan, and Tanzania.
Hackers affiliated with Iran's cyber-espionage group, MuddyWater, have extended their focus to target telecommunications companies in Egypt, Sudan, and Tanzania.
As revealed by cybersecurity researchers, including Marc Elias from Symantec, this marks a departure from MuddyWater's previous emphasis on entities in the Middle East, marking their first known operation against African organizations.
The cyber-attacks, conducted in November against unspecified telecom companies, have not shown evidence of successful information theft. However, analysts suggest that the primary objective of the campaign is likely espionage, based on MuddyWater's historical patterns. There is also speculation about the potential for disruption attacks, drawing on the tactics of Iranian hacking groups in the past.
The hackers' activities in Africa may be influenced by the ongoing Israel-Hamas conflict, with Egypt a prime target due to its proximity to Gaza and Israel.
MuddyWater's recent campaign, analyzed by Symantec, stands out for its use of a PowerShell launcher from a newly identified toolset called MuddyC2Go. Discovered in November, the toolset may have been operational since 2020, granting threat actors remote access to victim systems.
In addition to the PowerShell launcher, MuddyWater deployed other tools, including the legitimate remote device control and management software SimpleHelp. The software, once installed, operates as a system service, providing attackers continuous access and the ability to execute commands with administrator privileges.
Active since at least 2017, MuddyWater has consistently demonstrated an interest in targeting telecom organizations, aligning with broader trends observed among cyber-espionage groups.
Nonetheless, three Iranian newspapers ignored the censorship order and ran editorials on the biggest corruption case in several decades in their Wednesday issues. The case involved a tea company receiving billion of dollars from the government with favorable exchange rate for imports but selling the currency in the open market for a hefty profit.
The bravest article appeared on Jahan-e Sanat newspaper. Nader Karimi Jooni, one of the daily's editors wrote, "In a questionable measure, the Supreme National Security Council has called on media managers not to report anything on the corruption case at the Debsh Tea Company any longer." Jooni added that it is not strange that the issue of corruption has turned into a national security issue. "Earlier, not only the press, but also members of the public had been barred from speaking about corruption."
The article was referring to Supreme Leader Ali Khamenei's statement in 2015 ordering the people and the press “to stop discussing corruption as this would be disappointing for the country's officials." Khamenei made the statement after a big embezzlement case in the government-controlled banking system.
According to Jahan-e Sanat, such orders are at times also issued by the Iranian Judiciary, and those who refuse to obey the order will end up in jail. The daily pointed out that the SNSC's order is in contrast with President Ebrahim Raisi's frequently declared policy about confronting financial corruption. The newspaper then asked how a President, who calls for confrontation with corruption, can order the press to stop talking about the biggest such case in the past 45 years.
The daily concluded that either Raisi was not honest in making the statement about confronting corruption, or he does not want the issue to be tackled for some reason. The daily further insisted that the press should call for the punishment of those who have benefitted from illegal privileges and concession they received from the government.
Another Tehran daily, Abrar, pointed out that the recent Debsh Tea company’s case is the biggest instance of financial corruption in Iran and not only its managing director should be held accountable, but the government institutions involved in keeping the case secret for months. Presumably the all-powerful Judiciary, the Police, the Customs Administration and the Ministry of Intelligence were all aware and responsible for that. The daily said: "It is surprising that no action has been taken in this regard and no report has been given to the nation about the case. The officials are taking it easy and simply ignore the case as if nothing has happened."
Ironically, Abrar's article about the corruption case was printed next to an article in which President Raisi is quoted as saying that government watchdogs should go easy with managers of state companies and institutions.
The third Iranian daily that discussed the corruption case was Hamdeli, which featured two reports about the corruption case. In one article, Hamdeli wrote: "While the country is facing sanctions and economic difficulties, giving such a large amount of money to a company is an example of financial corruption. But is this going to be Iran's last corruption case?"
The daily then questioned supervisory organizations such as the parliament, the Central Bank of Iran, the Customs Administration's performance and asked why they did not notice such a big corruption taking place.
In another article Hamdeli noted that the tea company in question has also been involved in exporting bitumen on behalf of the government-owned oil industry. Meanwhile, other reports quoted Ahmad Osanlu, the head of the government's "Religious Punishments Organization" as having said that foreign currency continued to be allocated to Debsh even after the authorities received some 50 complaints about wrongdoings in the company.
All this come while Alireza Panahian, an insider at Khamenei's office has encouraged hardliners to gather wealth at any price. He further opined that the country's resources should be left in the hands of religious youths.
