Turkish government entity

Summary

The Iran-linked Chafer APT group targeted a Turkish government entity using a new Python-based backdoor called MechaFlounder, delivered through the win10-update[.]com domain and associated infrastructure. The malware, bundled via PyInstaller, functioned as a post-exploitation tool enabling file transfers, command execution, and persistent communication with command-and-control servers via HTTP. Attackers reused infrastructure previously tied to Chafer campaigns, with evidence suggesting potential code-sharing between Chafer and the Oilrig threat group. The backdoor encoded command outputs in base16 and leveraged the mechanize module for file exfiltration, demonstrating the group's focus on surveillance and data theft operations.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In November 2018, the Iran-linked Chafer APT group targeted a Turkish government entity using a new Python-based backdoor dubbed MechaFlounder. Attackers reused infrastructure previously associated with Chafer, specifically the domain win10-update[.]com, which resolved to IP address 185.177.59[.]70 during the campaign. Palo Alto Networks researchers confirmed the domain’s historical ties to Chafer based on prior 2018 campaigns documented by ClearSky. While the initial infection vector remained unobserved, analysts identified the secondary payload—MechaFlounder—hosted on the aforementioned IP. This marked the first Python-based malware employed by Chafer, bundled as a portable executable using PyInstaller. The group, active since at least 2014, historically focused on surveillance operations and data theft, aligning with MechaFlounder’s post-exploitation functions. The backdoor’s deployment suggested a deliberate shift in tooling, incorporating publicly available code snippets alongside custom development. Infrastructure reuse provided a tactical link to earlier Chafer activities, reinforcing attribution patterns observed in previous operations targeting Middle Eastern entities.

MechaFlounder operated as a persistent backdoor, establishing continuous HTTP communication with its command-and-control (C2) server. It executed core commands including file upload/download, system command execution, directory navigation, and sleep interval adjustments between C2 beacons. File exfiltration leveraged the Python mechanize module to submit stolen data via HTML forms, a feature influencing the malware’s naming convention. Command outputs and execution statuses were encoded using base16 before transmission. Analysis revealed shared code characteristics with VBScript downloaders previously deployed by both Chafer and Oilrig APT groups, suggesting potential tooling overlap or collaborative development. The malware’s functionality provided attackers with sufficient capabilities to conduct targeted data collection and system manipulation, consistent with Chafer’s espionage objectives. No specific impacts on the Turkish entity—such as data breaches or operational disruptions—were disclosed in available reporting. Palo Alto Networks’ publication in March 2019 documented the technical indicators and tactical evolution but did not reference containment measures or victim-led remediation efforts.

Sources

Sources available to members: 1 source.