NARRATIVE:
On March 26th 2019 an account on Telegram named لب دوخته گان (sealed lips) “Labdookhtegan1″ began dropping details on OilRig aka Muddywaters APT group on Twitter. The data that this account dropped consisted of names, details of the actors allegedly behind OilRig/APT34, and screen shots and details of compromised systems and tools being used by Iran. Since March the actors involved in dropping the dime have gone on to create two darknet sites as well as three accounts on Telegram where they dropped much of the same data. The Telegram and the successive Dookhtegan1 account(s) on Twitter also put out a video with their announcement. The video consists of clips of President Obama making a speech much like the kind of thing you see in movies threatening someone using sound bytes.
Analytics on Dookhtegan:
- Dookhtegan لب دوخته گان “sealed lips” as an image and a maxim was the creation of Mehdy Kavousi, an Iranian immigrant in the Netherlands who is protesting immigrant deportations. The image is famous and literally shows Mehdy with lips sewn together in protest.
- The original photo has been shopped by many including the actors here creating these accounts and dropping data
- Dookhtegan is only one of many accounts
- labdookhtegan
- labdookhtegan1
- Green_leaks
- Green_Leakers
- Bl4ck_B0x
- The data drops all included Farsi commentary as well as English
- The backstopping of the data is tied to actual compromised system addresses and files of malware
- Interestingly, the translations of Farsi to English seem to imply that the writer is not a native speaker of Farsi
DATA DROPPED:
The data dropped by these guys is rather splashy. They have named names of at least six guys and two companies in Iran they claim are part of MOIS/IRGC actor group
- Omid_Palvayeh
- alireza_ebrahimi
- mohamad masoomi
- saeid shahrab
- taha mahdi tavakoli
- Noorsec —>Sec Company
- Rahacrop –> Sec Company/School
All of the actors dossiers are included in my zipped drop below for you all to oggle. OSINT on these guys may come later but for now I am kinda meh, they are blown.
FILES DROPPED:
Labdookhtegan1 dropped many files as proofs of their work and outing of the IRGC. These included such things as passwords to compromised systems, tools they used, and other proofs to show IRGC activities on the following places of interest (see list pictured) The targets pretty much show activities in the middle east and areas that the IRGC would like to attack. Of course I am not seeing any US assets nor other areas, which, is rather interesting no? More on this in the context and timing section below….
I am currently looking at the technical tools and may have an update later on with tech details but for now, be happy with Uncle Krypt3ia’s gift of all the files and dox in one zip!
Tools, Techniques, and Assets
CONTEXT OF TIMING:
Right! So, the timing of these drops is rather convenient for the US huh? I mean, even as we speak Donny and his mustachioed pal Bolty are looking to maybe attack Iran for whatever reasons they have. The actors here try to make a case that perhaps they are in fact Turks, but I am kinda not buying that at all and the touches with “sealed lips” aka Mehdy Kavousi is also a nod toward some sympathy for Iranian immigrant feelings on deportation and feeling silenced. This too I am not buying, so once again that brings us back to the whole idea of “Cui Bono” and for me who really benefits here on so many levels would be America and the NSA perhaps or CyberCOMMAND?
So picture this… We decide to drop dox and TTP’s on Iran in the REGION as a means to blow IRGC out of the water and re-tool as we are ramping up for maybe some action in the region and we need, oh, let’s say, a receptive audience(s) in said region to help us were we to get kinetic with Iran. How’s that play for you all? It certainly plays for me. This is a stick that likely is dual edged and wins for us in my opinion. After all, the IRGC is in the regions playing their games as always, but the skinny recently is that IRGC messaged all their proxies and took them off the leash, and more to the point, in Iraq.
Think about that kids….
Say, didn’t we just pull out all our State folks from Iraq?
Why yes we did… Gee… WHO KNEW?!?!
Ponder that.
ASSESSMENT:
Overall these are interesting times and if you are in the game here and want to have all the fun bits, download the zip file with all the things. You’re welcome. I am glad to put it all in one place for you to have instead of playing games with all the companies out there trying to get you to buy their content while hiding the good shit behind a paywall. My assessment is this, that the players have been exposed, the companies they work for have been blown, and we all likely have much more to dig into now and coming soon. In fact a little birdie told me about a new dump this morning (yes it is in the zip file) so WHEEEEEEE!
Watch Iran and the region… I have a bad feeling.
K.
PS! I almost forgot.. I found some of the malware online in VT/Hybrid
https://app.any.run/tasks/a74d0d54-a996-4ae0-979f-675bbdd3bbad/
https://app.any.run/tasks/69ad1f9f-9dc4-475e-8762-b31283f314f1/
https://www.hybrid-analysis.com/sample/3c0c58d4b9eefea56e2f7be3f07cdb73e659b4db688bfbf9eacd96ba5ab2dfe5/5cdabffa028838cc0ea26b0a
Enjoy!
PPS! Almost forgot.. These cats even created a LinkedIN page for one of the burned!
*giggle*
