Suspected Iranian Actor Targeting Israeli Shipping, Healthcare, Government and Energy Sectors

UNC3890 uses at least two unique tools: a backdoor which Mandiant named SUGARUSH, and a browser credential stealer, which exfiltrates stolen data via Gmail, Yahoo and Yandex email services that we've named SUGARDUMP. UNC3890 also uses multiple publicly available tools, such as the METASPLOIT framework and NorthStar C2. In addition, Mandiant discovered UNC3890 operates an inter-connected network of Command-and-Control (C2) servers. The C2 servers host domains and fake login pages spoofing legitimate services such as Office 365, social networks such as LinkedIn and Facebook, as well as fake job offers and fake commercials for AI-based robotic dolls. Mandiant observed the C2 servers communicating with multiple targets, as well as with a watering hole that Mandiant believes was targeting the Israeli shipping sector, in particular entities that handle and ship sensitive components.