Iranian Threat Actor: Tools, Techniques, IOCs, and IOAs

Server: sdrhi  |  Primary C2: 157.20.182.49

On March 6, 2026, I was working a lead on an Iranian threat actor's infrastructure when I found an open directory on their operational server. The hostname was sdrhi. The IP was 157.20.182.49. The server was live. Python SimpleHTTP was running on port 8888. The directory was open.

I read everything.

What follows is a full technical report on what was there: the tools, the targets, the credentials, the malware, the exploit code, the victims, and the data they had already stolen. Nothing is redacted. These are real indicators from a live operation against real organizations.

The server was active at the time of analysis. The operational period runs from March 2025 through March 2026. The targeting is Israeli-primary with secondary targeting across Egypt, UAE, Jordan, Saudi Arabia, and Portugal.

Overview

Threat Actor Profile

Threat Actor Infrastructure

Phishing Infrastructure

sso.bookairway.com: Phishing site with Let's Encrypt SSL certificate, Apache reverse proxy to Python backend on port 8080.

DNS Exfiltration Callback

01d5ed12-3bb2-41b1-9315-2fa7140945e3.dnshook.site: Used for DNS-based data exfiltration (md5sum of payload sent via nslookup).

File Hashes

Webshell Indicators

Credential Artifacts

Resocks / Revsocks Encryption Keys

Staging Server Credentials

API Keys and Tokens

User-Agent string used in scanning: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36

Custom Attack Tools

owa.py: Async OWA Brute Forcer

owa-2.py: Threaded OWA Brute Forcer

web.py: File Exfiltration Server

reset.ps1: Obfuscated PowerShell Dropper (2.2MB)

A heavily obfuscated PowerShell script functioning as a malware loader using Node.js as a Living-off-the-Land Binary.

Obfuscation: Extensive junk variables, random GUIDs, meaningless function names, dead code branches.

Exploit Code

POC_ZZ_1.py: FortiOS CVE-2024-55591

Weaponized version of the watchTowr proof-of-concept for CVE-2024-55591 (FortiOS/FortiProxy authentication bypass via WebSocket). The actor modified this PoC to:

• Create super_admin accounts: FortiWiFi/FortiWiFi123, FortiSetup, FortiAdmin
• Add created users to VPN user groups: ssl-vpn-groupamoss, VPN-Users
• Enumerate existing VPN users and groups
• Hardcode victim-specific configurations with Israeli employee names: shachar, sigal, amos, sima, lev, gabi, roy
• Reference Israeli company email: offices@agentek.co.il
• Include encoded password hashes from compromised FortiGate devices

Custom Nuclei Templates

Meterpreter Payloads

19 Meterpreter payloads generated via msfvenom, all calling back to 157.20.182.49:443:

CVEs Exploited or Scanned

Confirmed Victims and Impact

Confirmed Compromised Organizations

Targeted Organizations (Recon / Scanning / Brute Force)

Data Exfiltration Evidence

EgyptAir Riyadh Station: Complete Data Theft

The threat actor's webserver (http://157.20.182.49:8888/webserver/) was hosting exfiltrated data from EgyptAir's Riyadh maintenance station. Data was exfiltrated using PowerShell WebClient.UploadFile() commands found in up.txt, targeting both the primary C2 (157.20.182.49:10443) and an AWS instance (ec2-18-223-24-218.us-east-2:443).

Cloud-to-Cloud Exfiltration

Rclone was used to copy ERPBackup data from Wasabi cloud storage (wasabbi:wasabirclone/ERPBackup) to Put.io (putio:/iiitdEDUin). The actor had access to an organization's ERP backup in Wasabi and transferred it to a personal Put.io account for persistent offline access.

TTPs: MITRE ATT&CK Mapping

Appendix A: Password Spray List (Top 50)

P@ssw0rd        P@ssw0rd123      123456           Password1        Welcome@123
admin@123       P@ssw0rd1        Welcome@1        admin123         Aa123456
P@ssw0rd2024    P@ssw0rd2025     March@2025       March@2026       October@2024
October@2025    December@2026    Welcome1         Password         12345
123123          P@ssw0rd12       P@ssw0rd11       L3tm31n          abc123
1qazZAQ!        qwer1234         Passw0rd         Password@123     Admin@123
Admin@1234      P@$w0rd         P@$w0rd1        Ch@nge#1         Ch@nge1#
Welcome@2024    Welcome@2021     Jan@2025         Berlin@2026      Honda@2026
P@kistan786     Cloud@393        Oracle@3535      Helpdesk@123     Support@1234
Pass@123456     password         12345678         123456789        Aa12345@

Appendix B: Target IP Ranges (Israeli Focus)

The ips.txt file contains 56 telnet (port 23) targets for CVE-2026-24061 exploitation, spanning Egyptian (41.x.x.x, 197.x.x.x) and Israeli IP ranges.

Recommendations

Immediate Actions

• Block attacker infrastructure: 157.20.182.49, 162.0.230.185, 194.11.246.101, 18.223.24.218
• Block phishing domain: sso.bookairway.com
• Block DNS exfiltration domain: *.dnshook.site
• Search all Exchange servers for Neo-reGeorg webshells: nfud.aspx in /aspnet_client/ paths
• Audit FortiGate admin accounts for unauthorized users: FortiWiFi, FortiSetup, FortiAdmin
• Force password reset for any account using passwords from the spray list above
• Review OWA authentication logs for brute force patterns from the identified attacker IPs

Patch Priority

ThreatHunter.ai is an 18-year SDVOSB cybersecurity company. This intelligence was collected from open-source analysis of exposed threat actor infrastructure. No systems were accessed beyond what was openly published by the actor. If your organization is listed above and has not yet been notified, contact us.