The communication between the malware and the C2 server is compressed via GZIP, AES encrypted and BASE64 encoded. The C2 server masquerades as an American flower shop and has been active since July 2020. Upon further analysis, X-Force determined “WhatsApp.apk” was Android malware that we named “LittleLooter” based on its information stealing capabilities.įor C2 communication, LittleLooter attempts to establish communication to the C2 server via HTTP POST requests and responses.

X-Force researchers discovered a file named “WhatsApp.apk” (md5: a04c2c3388da643ef67504ef8c6907fb) on infrastructure associated with ITG18 operations.įigure 1: Open Directory listing for ITG18 server hosting victim exfil and LittleLooter (Source: X-Force)

LittleLooter, ITG18’s Android Surveillance Tool Finally, despite continued OPSEC errors, ITG18 appears to conduct a sizeable and often successful operation that heavily focuses on compromising personal webmail and social media accounts. Given the timing and focus of the activity, this may have been in support of surveillance objectives leaving up to the June 2021 presidential elections in Iran. X-Force is not aware of other threat actors leveraging this backdoor.Īdditionally, from August 2020 through May 2021, X-Force observed ITG18 successfully compromise multiple victims aligned with the Iranian reformist movement. Our continued analysis led to the discovery of a malicious tool that has not been previously linked to this threat actor, a custom Android backdoor we named “LittleLooter.” LittleLooter has only been observed being used by ITG18. Since our initial report on the group’s training videos in May 2020, X-Force has uncovered additional operational security errors by this group. This group’s tactics, techniques and procedures(TTPs) overlap with groups known as Charming Kitten, Phosphorus and TA453. IBM Security X-Force threat intelligence researchers continue to track the infrastructure and activity of a suspected Iranian threat group ITG18. This blog supplements a Black Hat USA 2021 talk given August 2021.

Blackhat training videos download