Iranian cyberespionage operations are continuing at a steady pace, but so far no reaction has been spotted in response to the January U.S. drone strike that killed Iranian Gen. Qasem Soleimani.

Almost two months has passed since the Jan. 2, 2020 attack, Secureworks is only noting the continuation of previously implemented espionage operations from Iran/ These are primarily targeting governmental organizations in Turkey, Jordan, Iraq along with intergovernmental and other agencies in Georgia and Azerbaijan.

“Most of
this activity commenced prior to the U.S. drone strike. Victimology and code
similarity between the macros in the analyzed samples and macros documented in
open-source reporting suggest that these campaigns were conducted by the COBALT
ULSTER threat group (also known as MuddyWater, Seedworm, TEMP.Zagros, and
Static Kitten), which is tasked by the Iranian government,” Secureworks reported.

That does
not mean a cyberattack is not forthcoming. Secureworks noted that setting up a
major online effort requires time and Iran is known for using its cyber
capabilities to counterstrike its oppenents.

“In some
cases, these responses materialized several months after provocations toward
Iran occurred. However, Iran’s cyberespionage operations continue,” Secureworks
said.

Iran did
quickly resort to a military strike launching a missile attack that struck
several U.S. bases in Iraq in response to Soleimani’s killing.

With the operations currently underway attackers are using multiple rounds spearphishing attacks to gain entrance to the targeted systems. In some cases studied by researchers the emails contained links to malicious websites that allow the hacking groups to track their targets. In other attacks the email had a malicious spreadsheet attached that was socially engineered to match the subject line of the email to encourage the recipient to click.

Opening and enabling the attachment launches the embedded malicious VBScript which disables the machine’s security controls.

Several payloads
are then downloaded from an IP address hard-coded in the script.

Another
attack viewed by Secureworks saw the attackers again using a spearphishing
attack, but this time the malicious code was hidden inside an attached zip file
storing a malicious Excel file that required the victim to activate a macro. In
this case a new a previously unobserved RAT Securework’s researchers refer to
as ForeLord is dropped and executed.