Shahid Hemmat

Executive Summary

Shahid Hemmat, an Iranian IRGC‑CEC affiliated actor also known as Yellow Liderc, has repeatedly targeted U.S. critical infrastructure, most notably the Municipal Water Authority in Aliquippa, Pennsylvania where they allegedly disabled a booster station and disrupted drinking water supply. The U.S. government is offering a $10 million reward for information on key personnel such as Manouchehr Akbari and Amir Hossein Hoseini.

Goals & Targeting

Shahid Hemmat’s strategic objectives revolve around political coercion through disruptive sabotage of critical U.S. infrastructure. By targeting defense, aerospace, aviation, transportation, energy, water, and financial‐services sectors—particularly entities deemed vital for national security—the group seeks to undermine confidence in the U.S. domestic supply chain and exert leverage against Iranian sanctions or diplomatic pressures. Their chosen victims are typically large corporations with high public profiles or small municipal utilities that provide essential services, enabling a disproportionate impact relative to the effort required.

Key Capabilities

• Advanced spear‑phishing campaigns with macro‑laden Office documents
• Use of a broad range of RATs including PlugX, Brute Ratel C4, Poison Ivy, and Ghost RAT
• Credential harvesting via Agent Tesla and Mimikatz derivatives
• Exploitation of supply chains and third‑party services to deliver malware
• Remote administration through Windows Admin Shares (SMB) and PowerShell scripts
• Command‑and‑control over HTTPS/HTTP with domain generation algorithms
• Fast‑flux DNS for resilient C2 infrastructure
• Lateral movement via remote services and stolen credentials
• Evidence of exfiltration over established command‑and‑control channels
• Potential use of water‑system SCADA hijacking techniques

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Shahid Hemmat typically pursues low‑profile, yet high‑impact campaigns that focus on critical infrastructure. Operational tempo appears sporadic, with each engagement taking weeks to plan and months to execute, emphasizing thorough staging and post‑exploitation controls. The group leverages widely available malware families alongside custom script modules for lateral movement and persistence. Prior operations have included the Aliquippa water sabotage, suspected infiltrations of defense procurement vendors, and potential compromise of aviation maintenance facilities. Their attacks often surface after a prolonged dormant period, suggesting a strategic waiting game designed to maximize disruption when an organization’s security posture is weakest.

IOC Patterns

• Spear‑phishing emails containing malicious macro‑laden Office documents
• Use of compromised third‑party sites or watering holes for initial download
• Command‑and‑control over HTTPS/HTTP with domain generation algorithms (fast‑flux)
• Exfiltration via established C2 channels using encrypted tunnels
• Hosting command servers on bullet‑proof hosting platforms
• Suspicious usage of .gov domains to mimic legitimate communications

Recommended Actions

• Deploy enterprise‑level email security that blocks macro attachments and scans links for malicious payloads
• Segregate critical infrastructure networks from corporate LANs and enforce least‑privileged access controls
• Implement endpoint detection and response solutions capable of detecting RAT behaviors such as persistence scripts, SMB lateral movement, and credential dumping
• Monitor SCADA/PLC traffic for anomalies or unauthorized command sequences
• Apply timely patches to Office suite and other commonly targeted software
• Conduct regular phishing awareness training focusing on suspicious attachments and domain spoofing
• Integrate threat‑intel feeds to block known malicious domains and IPs associated with Shahid Hemmat activity
• Enhance logging of water‑system control equipment and perform continuous anomaly detection for operational technology

Suggested Tags