Iran regime hackers APT34 Helix Kitten launching DEADLY NEW BACKDOOR saitema against Jordan foreign ministry!!

Helix Kitten aka APT34

Malwarebytes reports that APT34 also known as the Helix kitten is on a destructive path and has released a new back door called saitema on victims this time at the Jordanian foreign Ministry!!! 

A malicious Excel document was discovered to place a new saitema backdoor on victims in the form of a deadly macro embedded in an Excel document. Helix kitten attack victims by sending a phishing e-mail to Jordanian ministry staff entitled "Receipt of Confirmation" with an Excel document attached. Sender of the malicious emails also pretends to be a Jordanian government official with a Jordanian logo on his email.

Malicious email sent by helix kitten to Jordan government 

Then when Excel document is opened an eNotif function is called which runs in the background and identifies the victim and their IP address as well as when malware commands are executed. eNotif also checks to see if mouse is connected to the victim's PC, and in that case, 'Update.exe', 'Update.exe.config' and 'Microsoft.Exchange.WenServices.dll' are created in the %APPDATA%/MicrosoftUpdate directory  that opens the back for saitema :(

Saitema backdoor is written in .NET that abuses the DNS protocol for its command and control communications Helix kitten uses techniques such as compression and long random sleep times to disguise malicious traffic in between legitimate traffic. backdoor is design as a finite state machine which means machine will change behavior depending on command sent which can be BEGIN END ALIVE SLEEP RECIEVE DO and SEND.

Saitema backdoor source code 

Malicious excel document and payload with victims targeted means that Malwarebytes say that APT34 aka Helix Kitten did this disgusting act against Jordan. Iranian regime will never stop interfering with others!! Please friends, never open excel documents that look deadly!! 

Iranian RANSOMWARE attack forces 157-year old School to CLOSE FOREVER 😡

Raisi does not fucking care about the youth and our children! 

This evil regime of Iran is hitting again and this time it is ruining the future of the youth!

Lincoln College in the United States is 157 years old and has survived the world wars, and due to the Iranian ransomware attack in December 2021, it has been forced to close forever when the money runs out.

Lincoln College lasted over 157 years before this Ransomware attack by regime forced it to close! 

More than 600 students are now affected by this vicious act of ransomware. The school paid more than $ 100000 to retrieve information blocked by the attack because the attack itself blocked access to data used in student recruitment as well as disrupted fundraising efforts for more than three months!

It follows a worrying trend that more than 1,000 schools were attacked ransomware last year. This disrupts the learning of children and students, as well as the huge cost of repair.

This regime is actively trying to destroy the lives of the youth! They must stop!