AppMilad

Executive Summary

AppMilad is an Iranian hacking group known for the RatMilad spyware campaign. They target primarily Middle Eastern enterprises through fake apps, aiming to gather corporate and personal information.

Goals & Targeting

AppMilad's goals appear to be centered around the acquisition of sensitive corporate information and personal data. By targeting Middle Eastern enterprises, they may be seeking to gather intelligence relevant to political or economic interests, possibly aligned with broader Iranian espionage objectives. Their choice of fake apps as a delivery mechanism indicates an understanding of target demographics and a desire for stealthy infiltration.

AppMilad is an Iranian threat group identified as the source of the RatMilad spyware. This malware infiltrates devices covertly, targeting corporate and personal data, including communications and photos. The group's primary method involves distributing malicious software through fake apps, particularly focusing on Middle Eastern enterprises. Their activities suggest a focus on intelligence gathering, likely for espionage purposes, with an emphasis on sectors that could provide strategic or economic advantages.

Key Capabilities

• Developing custom spyware (RatMilad)
• Distribution via fake applications
• Data exfiltration capabilities
• Persistent backdoor creation
• Surveillance toolkit implementation

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

AppMilad has been observed targeting Middle Eastern businesses over several years. Their campaigns typically involve initial infection through app distribution, followed by lateral movement within networks and data exfiltration. No specific high-profile campaigns have been widely reported beyond their use of RatMilad spyware.

IOC Patterns

• Spear-phishing emails with fake app download links
• Malicious app distribution via compromised or legitimate-looking stores
• C2 communication over HTTPS (potential anomalies)
• Registry entries or file patterns indicative of malware persistence

Recommended Actions

• Implement rigorous application vetting processes for enterprise devices.
• Monitor network traffic for unusual outbound communications, especially from internal systems.
• Educate users on the risks of downloading applications from unverified sources.
• Conduct regular endpoint detection and response (EDR) checks for signs of RatMilad infection indicators.
• Develop an incident response plan tailored to potential spyware incidents.

Suggested Tags