Whisper
Whisper is a 32-bit C#/.NET backdoor used by the Iran-aligned threat group BladedFeline, which ESET assesses with medium confidence to be a subgroup of OilRig. It has been observed in cyberespionage operations targeting Kurdish and Iraqi government officials, including Kurdistan Regional Government entities, and a regional telecommunications provider in Uzbekistan. The malware is described as offering remote code execution and data exfiltration capabilities.
Whisper operates by logging into a compromised Microsoft Exchange webmail account on an Exchange server and using that mailbox for command-and-control via email attachments. It creates or verifies an Exchange inbox rule named "MicosoftDefaultRules" that filters messages containing the string "PMO." It sends periodic check-in emails every 10 hours with the subject "Content" and a body containing a base64-encoded host identifier. Operator commands are base64-decoded and decrypted with AES. Reported capabilities include writing files, exfiltrating files, and executing PowerShell commands.
The malware has also been referred to as Veaty in reporting. High-confidence behavioral details directly mentioned in the source include its use of compromised Exchange webmail for covert communications, encrypted email attachments for tasking, and its role in long-term espionage campaigns conducted by BladedFeline against government and regional targets.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Whisper is a backdoor that logs into a compromised webmail account on a Microsoft Exchange server and uses it to communicate with the attackers via email attachments.
BladedFeline is known to employ a diverse malware toolkit, including backdoors like Shahmaran, Whisper, Spearal, and Optimizer, each offering remote code execution (RCE) and data exfiltration capabilities.
Techniques & procedures
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
1 technique
Initial Access
Execution
1 technique
Execution
Persistence
1 technique
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
4 techniques
Stealth
Eset first observed it in 2023, when it planted a backdoor into systems used by government diplomats from the Kurdistan Regional Government.
Both have timestomped PE compilation timestamps – a tactic that is common amongst Middle Eastern (and particularly Iran-nexus) threat groups... Both these versions of Whisper have timestomped compilation timestamps... BladedFeline routinely timestomps the compilation timestamps of malware that the group develops.
Command and Control
3 techniques
Command and Control
BladedFeline used a backdoor its dubs Whisper which, when planted inside a target device, logged into a compromised webmail account on a Microsoft Exchange server and used it to communicate with the attackers through email attachments.
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor used in targeted intrusions against Kurdish and Iraqi government officials.
Backdoor used by BladedFeline providing remote code execution and data exfiltration.
Backdoor malware used by the BladedFeline APT group to maintain access to compromised systems, exfiltrate data, and communicate with attackers via compromised webmail accounts.
C#/.NET backdoor that uses a compromised Microsoft Exchange webmail account for C2, communicating via email attachments.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.