Iranian Espionage Group Caught Spying On Kurdish Officials

An Iranian state espionage group stayed hidden for more than half-a-decade until security researchers spotted it in 2023, researchers said Thursday in a report detailing a growing arsenal of hacking tools it deployed against Kurdish and Iraqi government officials.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

Cybersecurity company Eset said telemetry shows the threat group it tracks as BladedFeline has been active since at least 2017. Eset first observed it in 2023, when it planted a backdoor into systems used by government diplomats from the Kurdistan Regional Government, a semi-autonomous region of Northern Iraq.

The group has expanded its toolset beyond the backdoor to include reverse tunnels and supplementary tools to exfiltrate information from hijacked devices to its command and control servers, Eset said.

Iran has maintained a neutral, sometimes supportive, stance towards Kurdish groups based in Iraq and the rest of Middle East, also running a brutal intimidation campaign against its domestic Kurdish population in response to uprisings and rights movements.

“Espionage can leverage intelligence to conduct future physical and cyberattacks against adversaries. With Iran’s ongoing aggression in the [Kurdistan Region of Iraq], these cyberespionage operations may allow it to intensify repression of Kurdish dissidents and expand their influence in Iraq,” the Washington D.C.- based Kurdish Peace Institute said in a 2022 report.

The Washington Kurdish Institute said Iran maintains a close watch on Iraqi Kurdistan as it views the region as a threat due to its relative autonomy and its hosting of U.S. troops.

Eset said that in its 2024 campaign, BladedFeline used a backdoor its dubs Whisper which, when planted inside a target device, logged into a compromised webmail account on a Microsoft Exchange server and used it to communicate with the attackers through email attachments. The targeted devices belonged to Kurdish officials, high-ranking Iraqi government officials and a regional telecommunications provider in Uzbekistan.

The security firm also observed BladedFeline deploying PrimeCache, an internet information services module that bore code similarities with the RDAT backdoor that an Iranian-nexus group Eset tracks as OilRig used in previous cyberespionage campaigns.

Eset said it assessed with medium confidence that BladedFeline is a subgroup of OilRig, an Iran-aligned APT group. OilRig is also known to run another subgroup, tracked by Eset as Lyceum, that uses several backdoors and cloud-based downloaders to spy on Israeli governmental, local governmental and healthcare organizations.