IOControl
IOControl is a malware that targeted Linux ARM-based IoT/OT devices including Hikvision IP cameras, D-Link firewalls and routers, Unitronics PLCs and HMIs, Orpak and Gasboy fuel management systems, and Baicells LTE controllers across the United States and Israel. The malware has been attributed to CyberAv3ngers which is suspected to be affiliated with the Iranian Government Islamic Revolutionary Guard Corps (IRGC).[1][2][3]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1037 | .004 | Boot or Logon Initialization Scripts: RC Scripts |
IOCONTROL has used an RC script ( |
| Enterprise | T1140 | Deobfuscate/Decode Files or Information |
IOCONTROL has used the AES-256-CBC algorithm to decrypt configuration files associated with the malware.[1] [4] |
|
| Enterprise | T1070 | .004 | Indicator Removal: File Deletion |
IOCONTROL has removed the malware binary and associated log file (i.e., |
| .009 | Indicator Removal: Clear Persistence |
IOCONTROL has removed malware persistence from a system upon command. [1] |
||
| Enterprise | T1027 | .002 | Obfuscated Files or Information: Software Packing |
IOCONTROL has used the Ultimate Packer for eXecutables (UPX) to pack the malware.[1] [4] |
| .013 | Obfuscated Files or Information: Encrypted/Encoded File |
IOCONTROL has used the Advanced Encryption Standard 256-bit Cypher Block Chaining (AES-256-CBC) algorithm to encrypt its configuration files which are used to store information like file paths and IP addresses to connect to. [1] [4] |
||
| Enterprise | T1082 | System Information Discovery |
IOCONTROL has used the |
|
| Enterprise | T1033 | System Owner/User Discovery |
IOCONTROL has used the |
|
| Enterprise | T1124 | System Time Discovery |
IOCONTROL has used the |
|
| ICS | T1701 | .003 | Command and Scripting Interpreter: Unix Shell |
IOCONTROL has executed arbitrary commands using system calls as well as scripts with the UNIX Shell.[1] |
| ICS | T0846 | .001 | Remote System Discovery: Port Scan |
IOCONTROL has conducted port scans on a network.[1] |
| ICS | T0869 | .001 | Standard Application Layer Protocol: DNS |
IOCONTROL has used DNS over HTTPS (DoH) via CloudFlare’s API to translate hostnames to IP addresses.[1][2][3] |
| .002 | Standard Application Layer Protocol: Publish/Subscribe Protocols |
IOCONTROL connects to C2 servers using the MQTT protocol over port 1883 and 8883 (encrypted via SSL/TLS). The command-and-control servers are resolved using DNS-over-HTTPS (DoH).[1][2][3] |
||