Recently, a cyber attack on Iran’s steel industry was reported by @GonjeshkeDarand. Check Point Research found files from the attack and tied the malware to last year’s attacks on Iran’s railways. According to Born’s summary of their analysis, the sample (called Chaplin by the attackers) is based on the Meteor wiper, but instead of wiping it blocks user interaction, logs the user off and shows a single-frame video. Stygian investigated the forensic reports and did pick out one aspect of the campaign. The malware displayed a video on the affected systems via Filter Graph COM object. At the same time, access to the affected system was likely blocked. The article includes a working proof-of-concept that displays a GIF and locks out the user of the system.
