UNC3890 is a suspected Iranian threat actor targeting Israeli sectors with SUGARUSH backdoor and SUGARDUMP credential stealer.
Analyst brief
UNC3890 is a suspected Iranian threat actor targeting Israeli shipping, government, energy, and healthcare sectors. It uses proprietary malware, including the SUGARUSH backdoor and SUGARDUMP browser credential stealer, which exfiltrates passwords to webmail services like Gmail, ProtonMail, Yahoo, and Yandex. The actor also leverages C&C servers hosting fake login pages to harvest credentials. Defenders should monitor for suspicious email-based exfiltration patterns and scrutinize anomalous PowerShell activity.
UNC3890
unknown
A suspected Iranian threat activity cluster has been linked to attacks aimed at Israeli shipping, government, energy, and healthcare organizations, in a campaign stretching back to late 2020. Researchers believe that the data harvested during the campaign could be used to support various activities. UNC3890, the threat actor behind the attacks, deployed two proprietary pieces of malware – a backdoor named “SUGARUSH” and a browser credential stealer called “SUGARDUMP”, which exfiltrates password information to email addresses registered with Gmail, ProtonMail, Yahoo and Yandex email services. The threat actor also employs a network of C&C servers that host fake login pages impersonating legitimate platforms such as Office 365, LinkedIn and Facebook. These servers are designed to communicate with the targets and also with a watering hole hosted on the login page of a legitimate Israeli shipping company.
What suspicious network traffic should defenders monitor to detect UNC3890's activities?+
Defenders should monitor for suspicious email-based exfiltration traffic to webmail services like Gmail, ProtonMail, Yahoo, and Yandex, as well as scrutinize anomalous PowerShell activity.
What proprietary malware tools are used by UNC3890?+
UNC3890 uses a proprietary backdoor named SUGARUSH and a browser credential stealer called SUGARDUMP, which exfiltrates password information to Gmail, ProtonMail, Yahoo, and Yandex email services.