Middle East Targeted By BackDoor Diplomacy With An Arsenal Of Commodity And Open Source Tools

Wielding an arsenal of tools easily obtainable through open sources such as GitHub, Backdoor Diplomacy targeted the Middle East in a recent espionage campaign. The threat actors gained access to the targeted environment through known vulnerabilities and deployed tools as well as used living off the land techniques to gather information on the victim’s infrastructure, used scan utilities to identify open ports or services as well as identified resources for lateral movement. BackDoor Diplomacy deployed multiple open-source proxy tools, commodity webshells and RAT’s, as well as used a redeveloped backdoor known as Qurian. The backdoor, which has not been seen since 2013 when the malware was redeveloped and renamed Turian.