Iran's APT34 Cyberespionage: Spying on Allies Iraq & Yemen

In the world of cyber warfare, loyalty and alliances are often murky. Iran, known for its strategic cyber operations, has been caught spying on its supposed allies, Iraq and Yemen. The latest findings from cybersecurity researchers reveal that Iran-linked APT34 (also known as OilRig, Helix Kitten, and MuddyWater) has launched espionage campaigns targeting government entities in these nations. Despite being considered Iran’s allies politically and economically, both Iraq and Yemen have been subjected to advanced cyberattacks orchestrated by Tehran’s Ministry of Intelligence and Security (MOIS).

APT34’s Espionage in Iraq

APT34’s cyber operations in Iraq date back to at least March 2024, when new malware samples surfaced on VirusTotal. These included three custom backdoors: Veaty, Spearal, and an unnamed SSH tunneling tool. The attackers cleverly disguised these as document files, suggesting they were distributed through phishing emails.

One of the most alarming discoveries was Veaty’s method of exfiltrating data. It used compromised Iraqi government email addresses to send stolen data, making it difficult to detect. APT34 also leveraged DNS tunneling and SSH connections for persistent access.

Despite being exposed in September 2024, APT34 has continued its operations by slightly modifying its infrastructure but maintaining the same attack techniques. Experts believe Iraq’s limited cybersecurity defenses have allowed these attacks to persist.

Iran’s Cyber Operations in Yemen

The cyber espionage campaign in Yemen was less sophisticated but still concerning. Instead of custom backdoors, this attack utilized Power Service, a PowerShell-based malware. The operation, which began in mid-2024, appeared to target organizations with links to both Iraq and Yemen.

APT34’s Yemen operations highlight how Iranian cyber actors share resources but operate in independent teams with customized tools. Some tools and infrastructure are common across campaigns, while others are unique to specific missions.

What Undercode Says:

The Pattern of Iranian Cyber Espionage

Iran has a long history of cyber operations, often blending espionage, influence campaigns, and disruptive attacks. The revelation that APT34 is targeting allies like Iraq and Yemen demonstrates a pattern of deep surveillance by Iranian intelligence. This approach mirrors strategies used by other cyber powers, such as China, Russia, and the United States, where allies are not exempt from intelligence gathering.

Why Spy on Allies?

Political Uncertainty: Iraq and Yemen, despite being Iranian allies, have complex internal politics. Iran’s government likely seeks real-time intelligence to anticipate shifts in leadership, policy, or military alignments.
Military Strategy: Given ongoing conflicts and regional instability, Iran wants detailed insights into military movements and foreign influence in both Iraq and Yemen.
Economic Interests: Cyberespionage can help Iran monitor economic policies, oil negotiations, and trade agreements, ensuring its own interests remain protected.

APT34’s Persistent Tactics

APT34 has consistently demonstrated a unique approach to cyber operations:

Phishing-Based Initial Access: Disguising malware as documents and using email-based exfiltration methods.
Multi-Layered Exfiltration: Utilizing SSH tunneling, DNS tunneling, and compromised email servers to extract data.
Adaptive Strategies: Even after exposure, the group alters its infrastructure slightly but retains core attack techniques.

Implications for Regional Security

Iran’s espionage campaigns highlight major cybersecurity gaps in Iraq and Yemen. Unlike heavily fortified nations with advanced cybersecurity infrastructures, these countries have limited resources to detect and counter sophisticated cyber threats. The ongoing APT34 campaigns suggest that:

Iraq and Yemen must strengthen their cybersecurity measures to defend against persistent threats.
International cybersecurity cooperation is crucial to mitigate Iranian espionage efforts.
Iran’s cyber operations will likely continue evolving, adapting to new defenses but maintaining its core objectives.

Comparing APT34 to Other Cyber Threat Groups

APT34’s activities resemble those of other nation-state hacking groups:

China’s APT41: Conducts cyberespionage on both allies and adversaries for political and economic intelligence.
Russia’s APT29 (Cozy Bear): Known for targeting Western governments, even those engaged in diplomatic relations with Russia.
North Korea’s Lazarus Group: Engages in cyber theft and espionage, often targeting financial institutions worldwide.

This comparison underscores that cyberespionage among allies is a global norm, not just an Iranian tactic.

Fact Checker Results:

Claim: Iran is spying on allies Iraq and Yemen.
✅ True – Confirmed by Check Point researchers, with technical evidence of APT34’s cyber operations.

– Claim: Iraq and Yemen lack cybersecurity defenses.

✅ True – Reports suggest these governments have limited resources to counter advanced cyber threats.

– Claim: APT34 only targets adversaries.

❌ False – Evidence shows Iranian cyber actors also spy on allied nations for intelligence gathering.

References:

Reported By: https://www.darkreading.com/cyberattacks-data-breaches/irans-mois-linked-apt34-spies-allies-iraq-yemen
Extra Source Hub:
https://www.quora.com
Wikipedia
Undercode AI