Haghjoyan hacker group

Self-Proclaimed Iranian Affiliation: The group explicitly identifies itself as an Iranian cyber army. This is a crucial distinction from many other threat actors who maintain anonymity or obscure their origins. This open affiliation strongly suggests, though does not definitively prove, a level of state support or tolerance. They have proclaimed their sympathy toward Russia as well, opening the possibility for the group to collaborate with Russian groups that target the US and Israel.

Emergence During Conflict: The timing of their appearance and the nature of their targets strongly suggest that Haghjoyan's initial motivation was directly related to the Israel-Hamas conflict. Their early activities focused on targeting Israeli infrastructure and systems.

Possible links to other groups: They are mentioned with other pro-Iranian groups like, Cyber Av3ngers, Cyber Toufan, and YareGomnam Team. Also, the group is believed to be linked to Homeland Justice, an Iranian psychological operation group that has been active since July 2022.

Evolution of Tactics: While initially associated with DDoS attacks, Haghjoyan's reported activities have expanded to include data leaks, defacement, and potentially the deployment of wiper malware. This evolution suggests an increasing sophistication and a broadening of their operational capabilities. Their use of pre-existing stolen data for propaganda purposes also demonstrates an opportunistic and adaptable approach.

Telegram Presence: The group used Telegram channels to announce its activities, shape public opinion, and disseminate political messages.

Distributed Denial of Service (DDoS) Attacks: Haghjoyan has been linked to DDoS attacks, a common tactic used to disrupt online services by overwhelming them with traffic. This aligns with their pro-Palestinian/anti-Israel stance, as DDoS is frequently used in politically motivated cyber campaigns. Protection tools can help mitigating the impact.

Data Leaks and Exfiltration: The group has claimed responsibility for stealing and leaking sensitive data, including information on U.S. military personnel. They have offered this stolen data for sale, typically requesting payment in Bitcoin. This indicates a financial motivation alongside their political goals.

Website Defacement: Altering the appearance of websites to display propaganda messages is another tactic employed by Haghjoyan. This serves both to disrupt services and to disseminate their political views.

Propaganda and Disinformation: Haghjoyan actively engages in propaganda campaigns, using their cyber activities and online presence (particularly on Telegram) to shape public opinion and spread their message. They have been observed misusing stolen credentials data to exaggerate their capabilities and create a false narrative of successful attacks.

Malware Deployment (Potentially Wiper Malware): Some reports and analyses connect Haghjoyan (or associated groups like Homeland Justice) to the use of wiper malware, such as the "No-Justice" wiper. This type of malware is designed to destroy data and render systems unusable, representing a significant escalation in destructive capability. However, direct attribution of specific wiper attacks to Haghjoyan requires careful verification.

Social Engineering (Potentially): While not explicitly confirmed in all sources, their association with groups known for social engineering (like Tortoiseshell) suggests a potential for similar tactics. This could involve using fake profiles or lures to gain access to systems or information.

Anti-ban tactics: They try to use anti-ban tactics. They do this by censoring words like "hacker", "target" and "fight" on social media.

Leveraging Existing Vulnerabilities: Instead of always developing new exploits, Haghjoyan has been observed exploiting existing vulnerabilities and using previously stolen data (e.g., credentials from infostealer infections) to further their goals. This highlights an opportunistic and resourceful approach.

Use of Legitimate Tools: Leveraging legitimate tools like Plink (PuTTY Link), RevSocks, and Windows 2000 resource kit for reconnaissance, lateral movement, and persistent remote access.

Primary Target: Israel: Israeli infrastructure, government systems, and organizations are the most frequent targets of Haghjoyan's attacks. This aligns with their pro-Palestinian/anti-Israel stance and their stated objective of supporting the Palestinian cause.

Secondary Targets: United States and Allies: Given Iran's geopolitical stance, entities in the United States and other countries allied with Israel are also potential targets. This includes military personnel, government agencies, and companies operating in sectors of strategic interest.

Specific Examples:

Industry Sectors: While specific industries are targeted based on the geopolitical context, Haghjoyan's operations could potentially affect a wide range of sectors, including:

Geographic Scope: While the Middle East is the primary focus, attacks could extend to other regions depending on the perceived alignment of countries with Israel or Iran.

Network Segmentation: Isolate critical systems and networks to limit the potential impact of a breach and prevent lateral movement.

Vulnerability Management: Regularly scan for and patch vulnerabilities, particularly in internet-facing systems and applications. Prioritize patch management for known exploited vulnerabilities.

Strong Authentication and Access Controls: Implement multi-factor authentication (MFA) for all critical accounts and enforce the principle of least privilege.

Endpoint Detection and Response (EDR): Deploy EDR solutions to monitor endpoint activity for malicious behavior and enable rapid response to threats.

Network Traffic Analysis: Monitor network traffic for unusual patterns, including large data transfers, connections to known malicious IP addresses, and unusual DNS requests.

DDoS Mitigation: Implement DDoS protection measures, such as traffic scrubbing and rate limiting, to mitigate the impact of denial-of-service attacks.

Security Awareness Training: Educate users about the risks of phishing and social engineering attacks. Train them to identify and report suspicious emails, links, and attachments. Different types of phishing can be used for these attacks.

Threat Intelligence: Leverage threat intelligence feeds and platforms to stay informed about the latest TTPs, indicators of compromise (IOCs), and emerging threats associated with Haghjoyan and similar groups. Understanding IoCs is very important.

Incident Response Plan: Develop and regularly test an incident response plan to ensure a coordinated and effective response to cyberattacks. Creating a CIRP can help respond to attacks.

Data Verification: Actively verify the claims and data of the group and other related groups.

Proactive Security Stance: Companies should follow the activities of the group and need to keep a proactive security stance.

Monitoring of Legitimate Tools: Monitoring of legitimate tools: Implement robust monitoring and auditing of legitimate tools (Plink, RevSocks, etc.) to detect unusual or unauthorized usage that might indicate attacker activity.

Security Monitoring: Continuous monitoring for IoCs associated with Iranian APTs. Security logging and monitoring is a crucial step.

Tortoiseshell APT

OilRig (APT34)

Iran Linked Hackers Deploy Sophisticated IOCONTROL Malware Targeting Critical Infrastructure

New FinalDraft Malware Leverages Outlook Drafts for Stealthy Cyber Espionage

Charming Kitten Deploys New C++ BellaCiao Malware Variant in Cyber Espionage Campaign