BladedFeline Exploits Whisper and PrimeCache to Breach IIS and Microsoft Exchange Servers

ESET researchers have uncovered a series of malicious tools deployed by BladedFeline, an Iran-aligned advanced persistent threat (APT) group, targeting Kurdish and Iraqi government officials.

Active since at least 2017, BladedFeline has been linked with medium confidence to the notorious OilRig APT group, known for cyberespionage across the Middle East.

Sophisticated Cyberespionage Campaign

The group’s latest arsenal, discovered in 2024, includes the Whisper backdoor and the PrimeCache malicious IIS module, which exploit Microsoft Exchange servers and Internet Information Services (IIS) to maintain persistent access to compromised systems.

This campaign not only highlights BladedFeline’s evolving technical prowess but also underscores the strategic importance of their targets, including the Kurdistan Regional Government (KRG), Iraqi government officials, and a telecommunications provider in Uzbekistan.

Delving into the technical underpinnings, the Whisper backdoor operates by infiltrating Microsoft Exchange servers through compromised webmail accounts, using email attachments as a covert channel for command-and-control (C&C) communication.

Written in C#/.NET, Whisper logs into these accounts, sets up inbox rules to filter specific messages, and executes commands such as file manipulation and PowerShell script execution, transmitting results back to attackers via encrypted attachments.

Its configuration, stored in an XML file with base64-encoded credentials, ensures seamless operation without user intervention.

Technical Intricacies of Whisper

On the other hand, PrimeCache, a native IIS module, functions as a passive backdoor by filtering HTTP requests with specific cookie headers to process operator commands.

Unlike its predecessors, it splits actions into multiple requests, storing parameters globally before execution, and employs RSA and AES-CBC encryption for secure C&C communication.

The similarities between PrimeCache and OilRig’s RDAT backdoor, including shared code structures and the use of the Crypto++ library, further cement the connection between BladedFeline and OilRig.

According to ESET researchers, the scope of BladedFeline’s operations reveals a calculated effort to sustain access to high-value targets.

Since 2017, the group has deployed various tools like the Shahmaran backdoor and reverse tunnels such as Laret and Pinar on KRG systems, alongside targeting Iraqi officials with tools uploaded to VirusTotal.

Their exploitation tactics, potentially involving vulnerabilities in internet-facing web servers, have allowed deployment of webshells like Flog, enhancing their foothold.

The geopolitical motivations are clear access to KRG’s diplomatic ties and Iraq’s strategic landscape post-US occupation offers significant espionage opportunities for Iran-aligned actors.

BladedFeline’s continuous development of malware, evidenced by tools like Slippery Snakelet and supplementary utilities, indicates a persistent threat that demands robust countermeasures.

Indicators of Compromise (IoCs)

Exclusive Webinar Alert: Harnessing Intel® Processor Innovations for Advanced API Security – Register for Free