APT

GreenCharlie Infrastructure Linked to US Political Campaign Targeting

The original image was generated by OpenAI's DALL-E and edited by the author. Source: OpenAI (August 2024)

Introduction

On August 20, 2024, Insikt Group released a comprehensive threat analysis report revealing a significant link between the Iran-backed GreenCharlie group and recent cyber espionage activities targeting US political campaigns. The report details the group's extensive use of malicious network infrastructure. It highlights its connection to the Islamic Revolutionary Guard Corps' Intelligence Organization (IRGC-IO).

Report Overview

GreenCharlie, an advanced persistent threat (APT) group, has been tracked by Recorded Future since 2020. The group's activities have consistently overlapped with known Iranian cyber-espionage entities such as Mint Sandstorm, Charming Kitten, and TA453. The latest findings reveal that GreenCharlie is likely operating under the direct influence of the IRGC-IO, focusing on high-value targets, including government officials, diplomats, and research analysts.

GreenCharlie employs a sophisticated approach to its cyber operations. The group has registered numerous dynamic DNS (DDNS) domains using providers like Dynu, DNSEXIT, and Vitalwerks. These domains have been leveraged for spearphishing campaigns and social engineering attacks, often involving malware such as POWERSTAR, NokNok, and GORBLE. The infrastructure analysis uncovered by Recorded Future's Network Intelligence indicates that GreenCharlie uses multiple top-level domains (TLDs) and hosting providers, with a significant portion of its infrastructure hosted on Scalaxy B.V.

The implications of GreenCharlie's operations are far-reaching. While direct evidence of targeting US government officials is not yet confirmed, the infrastructure linked to GreenCharlie has been associated with campaigns targeting US political figures. The use of ProtonVPN and ProtonMail by the group suggests a high level of operational security, complicating efforts to track and mitigate these threats. The potential consequences include compromised sensitive information and strategic intelligence, which could influence political processes and decision-making.

Insights and Analysis

Insikt Group's findings are based on meticulous tracking of GreenCharlie's infrastructure, a process that instills confidence in the thoroughness of our analysis. This tracking has revealed the group's reliance on encrypted communication channels and obfuscation techniques. The detailed analysis of the GORBLE, POWERSTAR, and TAMECAT malware families underscores the sophistication of these cyber threats.

Organizations, especially those involved in political campaigns or sensitive government operations, are advised to bolster their cybersecurity defences. This includes implementing advanced threat detection systems, a measure that will make you feel secure and prepared, educating staff on spearphishing tactics, and ensuring secure communication channels.

GreenCharlie's ongoing activities represent a significant threat to US political campaigns and high-value targets worldwide. The group's sophisticated use of dynamic DNS domains, encrypted communication, and advanced malware requires vigilant monitoring and robust defensive strategies to mitigate the risks posed by this Iran-backed APT group.

Indicator	Type	Description
`activeeditor[.]info`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`personalwebview[.]info`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`longlivefreedom.ddns[.]net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`hugmefirstddd.ddns[.]net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`icenotebook.ddns[.]net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`softservicetel.ddns[.]net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`configtools.linkpc[.]net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`webviewerpage[.]info`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`www.selfpackage[.]info`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`selfpackage[.]info`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`itemselectionmode[.]info`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`termsstatement.duckdns[.]org`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`mobiletoolssdk.dns-dynamic[.]net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`researchdocument[.]info`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`timelinepage.dns-dynamic[.]net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`searchstatistics.duckdns[.]org`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`messagepending[.]info`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`www.chatsynctransfer[.]info`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`synctimezone.dns-dynamic[.]net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`chatsynctransfer[.]info`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`timezone-update.duckdns[.]org`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`onetimestorage[.]info`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`towerreseller.dns-dynamic[.]net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`translatorupdater.dns-dynamic[.]net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`api.overall-continuing[.]site`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`backend.cheap-case[.]site`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`admin.cheap-case[.]site`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`demo.cheap-case[.]site`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`dev.cheap-case[.]site`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`app.cheap-case[.]site`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`api.cheap-case[.]site`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`editioncloudfiles.dns-dynamic[.]net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`fileeditiontools.linkpc[.]net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`entryconfirmation.duckdns[.]org`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`doceditor.duckdns[.]org`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`projectdrivevirtualcloud.co[.]uk`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`continueresource.forumz[.]info`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`destinationzone.duia[.]eu`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`onlinecloudzone[.]info`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`storageprovider.duia[.]eu`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`lineeditor.32-b[.]it`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`lineeditor.001www[.]com`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`lineeditor.mypi[.]co`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`dynamicrender.line[.]pm`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`nextcloudzone.dns-dynamic[.]net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`realpage.redirectme[.]net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`sharestoredocs.theworkpc[.]com`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`thisismyapp.accesscam[.]org`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`thisismydomain.chickenkiller[.]com`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`pagerendercloud.linkpc[.]net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`splitviewer.linkpc[.]net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`pageviewer.linkpc[.]net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`preparingdestination.fixip[.]org`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`joincloud.mypi[.]co`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`joincloud.duckdns[.]org`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`realcloud[.]info`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`directfileinternal[.]info`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`sourceusedirection.mypi[.]co`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`viewdestination.vpndns[.]net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`overflow.duia[.]eu`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`tracedestination.duia[.]eu`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`continue.duia[.]eu`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`linereview.duia[.]eu`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`highlightsreview.line.pm`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`nextcloud.duia[.]us`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`smartview.dns-dynamic.net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`contentpreview.redirectme[.]net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`finaledition.redirectme[.]net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`dynamictranslator.ddnsgeek[.]com`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`personalstoragebox.linkpc[.]net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`personalcloudparent[.]info`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`cloudarchive[.]info`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`cloudregionpages[.]info`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`streaml23.duia[.]eu`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`pkglessplans[.]xyz`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`worldstate.duia[.]us`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`callfeedback.duia[.]ro`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`reviewedition.duia[.]eu`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`filereader.dns-dynamic[.]net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`vector.kozow[.]com`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`cloudtools.duia[.]eu`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`uptimezonemetadta.run[.]place`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`documentcloudeditor.ddnsgeek[.]com`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`coldwarehexahash.dns-dynamic[.]net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`readquickarticle.dns-dynamic[.]net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`uptime-timezone.dns-dynamic[.]net`	Domain	Likely used for GreenCharlie-related phishing or social engineering activities.
`185.241.61[.]86`	IP Address	Hosting GreenCharlie-related malicious infrastructure.
`172.86.77[.]85`	IP Address	Hosting GreenCharlie-related malicious infrastructure.
`146.70.95[.]251`	IP Address	Hosting GreenCharlie-related malicious infrastructure.
`91.232.105[.]185`	IP Address	Hosting GreenCharlie-related malicious infrastructure.
`54.39.143[.]112`	IP Address	Hosting GreenCharlie-related malicious infrastructure.
`38.180.91[.]213`	IP Address	Hosting GreenCharlie-related malicious infrastructure.
`38.180.123[.]135`	IP Address	Hosting GreenCharlie-related malicious infrastructure.
`38.180.123[.]113`	IP Address	Hosting GreenCharlie-related malicious infrastructure.
`38.180.123[.]187`	IP Address	Hosting GreenCharlie-related malicious infrastructure.
`38.180.146[.]214`	IP Address	Hosting GreenCharlie-related malicious infrastructure.
`38.180.146[.]212`	IP Address	Hosting GreenCharlie-related malicious infrastructure.
`38.180.146[.]194`	IP Address	Hosting GreenCharlie-related malicious infrastructure; communicated with Iran-based IP addresses.
`38.180.146[.]174`	IP Address	Hosting GreenCharlie-related malicious infrastructure; communicated with Iran-based IP addresses.
`38.180.123[.]231`	IP Address	Hosting GreenCharlie-related malicious infrastructure.
`38.180.123[.]234`	IP Address	Hosting GreenCharlie-related malicious infrastructure.
`38.180.146[.]252`	IP Address	Hosting GreenCharlie-related malicious infrastructure.
`37.1.194[.]250`	IP Address	Hosting GreenCharlie-related malicious infrastructure.
`193.111.236[.]130`	Iran-based IP Address	Communicated with GreenCharlie-related malicious infrastructure.
`185.143.233[.]120`	Iran-based IP Address	Communicated with GreenCharlie-related malicious infrastructure.
`94.74.175[.]209`	Iran-based IP Address	Communicated with GreenCharlie-related malicious infrastructure.
`94.74.145[.]184`	Iran-based IP Address	Communicated with GreenCharlie-related malicious infrastructure.
`93.119.48[.]60`	Iran-based IP Address	Communicated with GreenCharlie-related malicious infrastructure.
`37.148.63[.]24`	Iran-based IP Address	Communicated with GreenCharlie-related malicious infrastructure.
`37.255.251[.]17`	Iran-based IP Address	Communicated with GreenCharlie-related malicious infrastructure.
`5.106.153[.]245`	Iran-based IP Address	Communicated with GreenCharlie-related malicious infrastructure.
`5.106.169[.]235`	Iran-based IP Address	Communicated with GreenCharlie-related malicious infrastructure.
`5.106.185[.]98`	Iran-based IP Address	Communicated with GreenCharlie-related malicious infrastructure.
`5.106.202[.]101`	Iran-based IP Address	Communicated with GreenCharlie-related malicious infrastructure.
`5.106.219[.]243`	Iran-based IP Address	Communicated with GreenCharlie-related malicious infrastructure.
`C3486133783379e13ed37c45dc6645cbee4c1c6e62e7988722931eef99c8eaf3`	Malware Hash	Linked to GreenCharlie; variant of POWERSTAR malware.
`33a61ff123713da26f45b399a9828e29ad25fbda7e8994c954d714375ef92156`	Malware Hash	Linked to GreenCharlie; variant of POWERSTAR malware.
`4ac088bf25d153ec2b9402377695b15a28019dc8087d98bd34e10fed3424125f`	Malware Hash	Linked to GreenCharlie; variant of POWERSTAR malware.

MITRE ATT&CK Table

Tactic	Technique	ID	Description
Initial Access	Spearphishing Link	T1566.002	GreenCharlie used spearphishing links to gain access to targets.
Command and Control	Application Layer Protocol: Web Protocols	T1071.001	GreenCharlie used web protocols for command and control communications.
Persistence	Boot or Logon Autostart Execution: Registry Run Keys/Startup Folder	T1547.001	Malware associated with GreenCharlie likely established persistence through registry keys.
Resource Development	Acquire Infrastructure: Domains	T1583.001	GreenCharlie registered numerous domains via DDNS providers for their infrastructure.
Resource Development	Establish Accounts: Email Accounts	T1585.002	The group possibly created ProtonMail accounts to facilitate their operations.
Execution	Command and Scripting Interpreter: PowerShell	T1059.001	Malware linked to GreenCharlie executed via PowerShell scripts.
Discovery	System Information Discovery	T1082	GreenCharlie malware collects system information as part of its reconnaissance activities.
Discovery	Process Discovery	T1057	The malware gathers information about running processes on the infected system.
Command and Control	Application Layer Protocol: Web Protocols	T1071.001	Used to communicate with command and control servers via standard web protocols.