Greenbug
Greenbug is an Iranian threat actor associated in the provided reporting with credential theft, remote access tooling, DNS-tunneling command-and-control, and infrastructure impersonating regional technology and security companies. The content links Greenbug to activity supporting Shamoon operations against Saudi organizations, where the group was assessed to help steal user credentials ahead of destructive attacks. Researchers also reported Greenbug registering lookalike domains impersonating Israeli high-tech and cybersecurity companies, as well as a Saudi electrical testing and commissioning company, and using domains such as thetareysecurityupdate[.]com and securepackupdater[.]com for command and control. The group is associated with the ISMdoor/Ismdoor remote access trojan and related tooling referred to in the content as ISMAgent. Reporting cited in the content states Greenbug used HTTP-based C2 in earlier versions and later shifted to covert DNS-based C2, including DNS TXT and AAAA queries for bidirectional communications, command delivery, and data exfiltration. The DNS channel was described as rare, covert, and suited to long-term operations. The content also notes that ISMAgent used a DNS tunneling protocol very similar to ISMDoor, and separate reporting linked ISMAgent/ISMDoor-style tooling to OilRig tradecraft. The analyzed Greenbug RAT existed in at least three versions, with the latest identified as version 5.0.0. Across versions it used timer-queue callbacks and multiple threads to manage execution, connectivity checks, and command retrieval. It communicated with update.winappupdater.com over HTTP paths including /Home/CC and /Home/CR, and referenced /Home/SCV, /Home/BM, /Home/AV, /Home/CR, and /Home/CC. Capabilities described in the content include self-update, self-removal, configuration retrieval, command execution, host and network reconnaissance, security-product enumeration via WMIC against root\SecurityCenter and root\SecurityCenter2, keylogging via WinIt.exe, Powercat-based shell access to a remote server on port 4444, and Mimikatz execution. The SI functionality collected username, IP configuration, net view output, domain administrator user information, current network connections, system information, task lists, services, and security product information. The content also states the malware used PowerShell UAC bypass scripts including Invoke-BypassUAC and Invoke-PsUACme. Known aliases and related names directly mentioned in the content include Greenbug, ISMdoor/Ismdoor, and ISMAgent.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Software & Services
- Commercial & Professional Services
Where they target
Geographies tied to known operations.
- 🇮🇱 Israel
- 🇸🇦 Saudi Arabia
Where they're from
Attributed origin per open-source reporting.
- IR
Tradecraft
22 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
5 malware families attributed to this actor across reporting.
Observables
33 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced only as a separate cluster previously linked to ISMDoor; mentioned to contextualize similarities between ISMAgent and ISMDoor DNS-tunneling behavior.
Registered lookalike domains impersonating Israeli high-tech and cybersecurity companies, and used ISMdoor samples and related command-and-control infrastructure in a likely targeting campaign.
Credential-theft and remote access activity supporting Shamoon operations, including use of the Ismdoor RAT with DNS-based C2 (DNS tunneling/DNSMessenger-style) to issue commands and exfiltrate data; uses credential dumping (likely Mimikatz) and keylogging to harvest credentials ahead of destructive attacks.
Uses a remote access Trojan for cyberespionage and victim information collection; according to Symantec, the RAT and other tools were used to collect user information later used in execution of the wiper malware Disttrack.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.