ForeLord
FORELORD is a previously unobserved remote access trojan (RAT) identified by Secureworks CTU and associated with the Iranian state-linked espionage group COBALT ULSTER, also known as MuddyWater, Seedworm, TEMP.Zagros, and Static Kitten. CTU observed it in late 2019 and early 2020 in spearphishing campaigns targeting non-governmental organizations and Middle Eastern government entities; broader COBALT ULSTER activity in the same period also targeted government organizations in Turkey, Jordan, and Iraq, as well as intergovernmental organizations and entities in Georgia and Azerbaijan. Delivery involved ZIP archives containing malicious Excel files with obfuscated macros. In the FORELORD infection chain, the Excel file used cmd.exe to run a batch script (tt.bat) that established persistence via a registry key for restart, and a PowerShell script then used rundll32.exe to execute the FORELORD payload as Exchange.dll. FORELORD uses a DNS-based command-and-control protocol over DNS TXT records, including DNS tunneling through legitimate resolvers to actor-controlled nameservers. CTU reported that its protocol uses the response string "lordlordlordlord" to acknowledge message reception. By pivoting on this C2 protocol, CTU identified 14 additional domains possibly registered by COBALT ULSTER. Post-compromise activity observed alongside this intrusion set included credential dumping and validation using PASS32.dll, PASS64.dll, PasswordDumper.exe, Caller.dll (a Mimikatz variant), and CredNinja.ps1, as well as use of Secure Socket Funneling (ssf.exe) to create a TLS tunnel and port forwarding, potentially enabling RDP access.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In late 2019/early 2020, CTU researchers observed COBALT ULSTER targeting non-governmental organizations (NGOs) and Middle Eastern governments using malware CTU researchers named FORELORD based on behavioral aspects of the malware's C2 communications.
"In late 2019/early 2020, CTU researchers observed COBALT ULSTER targeting non-governmental organizations (NGOs) and Middle Eastern governments using malware CTU researchers named FORELORD based on behavioral aspects of the malware's C2 communications."
"In late 2019/early 2020, CTU researchers observed COBALT ULSTER targeting non-governmental organizations (NGOs) and Middle Eastern governments using malware CTU researchers named FORELORD based on behavioral aspects of the malware's C2 communications."
"In late 2019/early 2020, CTU researchers observed COBALT ULSTER targeting non-governmental organizations (NGOs) and Middle Eastern governments using malware CTU researchers named FORELORD based on behavioral aspects of the malware's C2 communications."
Techniques & procedures
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
2 techniques
Initial Access
Execution
1 technique
Execution
Stealth
1 technique
Stealth
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Previously unobserved remote access trojan delivered via malicious Excel macro. Executed via rundll32.exe loading a DLL (e.g., Exchange.dll), persists via a registry run key/batch script, and uses a DNS-based C2 protocol leveraging DNS TXT records (DNS tunneling) with a response string ("lordlordlordlord") used as part of its C2 acknowledgement/logic.
Custom malware used by COBALT ULSTER against NGOs and Middle Eastern governments; named by CTU researchers based on its command-and-control communication behavior.
Custom malware used by COBALT ULSTER against NGOs and Middle Eastern governments; named by CTU researchers based on its command-and-control communication behavior.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.