Researchers have published a new report on the recent targeting of an unknown Middle East government in an eight (8) month long campaign by the Iranian Crambus espionage group. Crambus (otherwise known as OilRig, MuddyWater, and APT34) is known for historically targeting various countries, including Saudia Arabia, Israel, the United Arab Emirates, Iraq, Jordan, Albania, the United States, and more, as well as conducting “long-running intrusions for intelligence gathering and spying purposes.” This latest campaign ran from February 2023 to September 2023 and involved the deployment of “PowerExchange”, a PowerShell backdoor. PowerExchange was used to monitor incoming mail sent from a Microsoft Exchange server to compromised mailboxes to execute commands embedded in malicious emails as well as forward results to the threat group. The malware was observed creating an Exchange rule titled “defaultexchangerules” to filter emails sent by the actor (which contained “@@” in the subject) and move them to the Deleted Items folder. Researchers also observed three (3) additional previously undiscovered malware families: “Tokel”, “Dirps”, and “Clipog”. Tokel is a backdoor used to execute arbitrary PowerShell commands and download targeted files. Dirps is a trojan that enumerates files in a desired directory and executes PowerShell commands. Clipog is an information-stealer that harvests clipboard data and keystrokes. Mimikatz, a credential dumping tool, and Plink, and command-and-control (C2) tool, were also utilized by Crambus in this campaign. Additional details of the attack timeline as well as indicators of compromise (IOCs) can be viewed in the report linked below.