"Let Me Build Your CV": Unmasking GRITCASPIAN’s Invisible Recruitment Trap - Asli Koksal

Welcome everyone. Uh imagine you're a high-value target working in a defense industry and uh you're receiving a highly personalized uh targeted outreach from a recruiter that is working in a major global contractor. And their offer is simple. Um get our uh go to our download our uh custom uh desktop application to build your CV um that will fit our corporate uh structure corporate format or uh take one of our personal assessments uh so you're eligible to fit our uh elite projects uh before applying to any of our positions. Um so Grid Caspian uses this as their lures for the targets. Today in this session, I'm going to uh uncover Grid Caspian an a long-forgotten uh Iranian

espionage group that is active since at least 2022. Um Okay, it was working. Yeah. Uh before diving deep into the technical details, let me give a quick introduction about my background. I'm Asil Koksal. I'm working uh as a threat researcher senior threat researcher in GTIG. Uh I'm responsible for uh tracking and hunting for Middle Eastern state-sponsored actors. And this is my fourth time being in BSides Dublin, third time as a speaker. I'm so grateful to be back here uh seeing all these familiar faces, new faces. So, uh it's really great to be back here. Fun fact about me, if I had to choose just one superpower, it would be definitely traveling in time and space.

So, anything time travel related, I just love it. Uh this talk will today the the the today's talk will be um into can we can uh see it in four distinct phases. The first one that I'm going to uh uh introduce you the Great Caspian. Uh then I will start giving some technical details about their custom malwares and then I will continue for um how they're exfiltrating data uh how they extract the data from the their targets. And then I will end this talk by giving some opsec failures that they did which helped us uh to track down track uh Great Caspian. So who is Great Caspian? Great Caspian uh for the people who's going to search

this in GTI or uh who's like more familiar with uh APT or ANK naming schemes, uh it is ANK 6446. Uh it's an suspected Iranian Nexus espionage group conducting uh cyber espionage operations um using custom-built applications such as um impersonating or masquerading as recruitment uh themed applications since at least 2022. Uh they're primarily targeting targeting defense industrial base, uh logistics and supply chain, geopolitical and governmental organizations that are in Iranian interest. Uh the targeting is heavily focused on Middle East and uh we suspect with low confidence that Great Caspian overlaps with Dust Sky which is ANK 4444 and both Dust Sky and Great Caspian is operating on behalf of the IRGC. For initial access, uh Great Caspian uh

relies heavily on uh long-term uh HR personas um and they interact with the targets via email, LinkedIn, uh and or Facebook. Uh the And instead of sending simple malicious applications to the target, they the target is lured to download some custom applications that fits the social engineering narrative. And these applications generally include CV building applications or personality test applications. And while the user is busy with building their CV or taking the test, these applications are on the silently on the background they profile the host and or drop next stage backdoors or next stage malware. For defense evasion, they are using steganography that I'm going to mention in the next slides that you will see. They are exfiltrating the data with

within the PDF files that are generated by these applications. And for in their custom built malware, they use packing and they also use encryption for when they're exfiltrating this data. As I said, they're primarily they're primarily targeting Middle East, but we've also seen cases frequently that they are extending their operations to the UK, US, and Europe, too. Great Caspian maintains a massive multi-language malware arsenal and as of today we identified at least 13 different code families from their side. And you can see that they have some families that are still active like since that they build it in 2022 and it's still active in the late 2025. But if you look at closely to the chart,

you will you will see a kind of a behavioral shift uh around the beginning of 2024 where they started to build, develop, um and deploy new malwares, and they also have shorter uh operational window than the ones that are compared in uh the ones for the 2022. I said this group is active since at least 2022, and actually this is the first public public talk about this group. Um and among this time uh along this time we've seen they also had changed their uh tradecraft from being super noisy uh to more silent operations. For the initial operations, they were testing their malwares in VirusTotal. They were um using open directories uh host to to host their malware or to

deliver their malware. They were leaving the jump jungle debug mode uh enabled, so giving us valuable information. Uh they were using they were generally you will see when I'm talking about the malware, but when they were delivering the malware, they are uh delivering it in password-protected archive files, and they were using like trivial passwords like 123. Um and they were also using the same hardcoded uh AES keys in between different code families. If we move today or closer around 24 or uh beginning of 25, they kind of uh shifted from more being more noisy or loud to more hidden and silent. Uh so their C2 infrastructure started to leverage Google Sheets, Google Drive, or uh Cloudflare Workspace

uh workers. Um and this made them to blend in the enterprise uh network traffic. They started to retrieve the keys encryption keys directly from the C2 instead of using the hard-coded keys. Also, they started to change use different keys for each operation or each even though if it's in the same code family, they started to use different key for each sample. They started to still deliver the malware in password-protected archive files, but that archive files started to be having non-trivial password, so it's not easy for us to gather that final payload from the archive file. They started to as you've seen on the previous malware chart, you they they started to build new malware and then they started to use

them with shorter period of time, so which makes our hunting rules basically gone and then we have to build new and new hunting rules for each new malware. If I start to give some of the malware examples from their inventory, it will I will start with CarSeat. This is a lightweight .NET dropper and then it is the it is one of the ones that started from 2022 that comes up until late 2025. It's their oldest and most consistently reused code family. It is again as I mentioned delivered by password-protected archive files, which in the initial phases that it was easy for us to get that final payload from the from the archive file. And it presents a functional CV builder

UI to the target and on the background it profiles the host. Also, as I said, it's a dropper, so it drops it it serves as the the primary stage for dropping the backdoors like Super Sedan or Ear Snake. Um, so it's depends upon the hard-coded config value in the sample. It decides which backdoor that it's going to drop. Uh, I said that this is their one of their oldest uh code family, so it was active since 2022. So, for 4 years we we have seen different versions of this malware where they are mostly using CV building UIs, but this was like if you see this, this is more kind of like a generic application, but during this

time we've also seen them with the the same functionality, but instead of this UI it had like the the masqueraded uh company logo in the in the application. So, you were really thinking that you were creating a CV that is fitting the application uh the corporate format, uh but actually it's on the behind it's doing uh malicious stuff. So, the target is uh it has the the Windows that the target is really uh thinking that it's building the CV. Uh it provides their uh the target provides their um uh their information about like the education or skills or um uh background about them, and when the target is busy uh with building this all this uh giving

all this information, background in the background uh Car Seat basically runs some a suite of recon commands. And what is interesting with Car Seat when it gathers that outputs of these commands um it doesn't immediately send all the collected information with a loud network traffic, even though they had really low operations or low uh noisy stuff, they just don't send it with a low network traffic. It keeps everything local and it has a hard coded encryption key. It just gets this data encrypted with that hard coded key and I'm waiting until the user finishes their job and then ready to generate their final PDF. When the target is ready to create their PDF, it shows this I'm not going to say

it's nice, but who am I to judge if a company or a creator wants this kind of format and if the target is wants to get to that job, they're okay to send this file. So, they this file is generated with the information that the target provided and then the target thought that it's a CV that's the the the recruiter wants. However, this PDF also contains the information not only from the provided from the target, but also the the output from the commands. Again, it's about the target, but it's about the target the the system of the target using. Car seat appends all this encrypted data that is collected from the commands at the end of the

file with a with a microscopic white font. So, to any human visual verification, this file just looks like like a normal CV or to any traditional network perimeter security, this is also like a standard user generated text traffic. So, this is basically invisible to human eye, but fully readable by the attacker. And with this steganography mechanism, basically, the malware completely bypasses traditional network layer traffic or the IP gateways. And what is interesting here is how do they get this file? So, first of all, it was a social engineering that the whole operation was a social engineering activity. So, basically, the target involuntarily sends the CV to the attacker. So, attacker gets the target thinks that they are sending their CV

and basically, the attacker gets They don't care about the target informa- information, but they get this file that microscopic font, so they can decrypt it and they will get the information about the target host. If that doesn't work, if somehow the target gets aware, oh, what am I doing? Still, as I said, Car Seat was a dropper, so it was dropping backdoors. So, the the the attackers can have this file or not only this file, but they will have access to the target systems by the dropped backdoors. Um this is another one in their malware inventory. It's Raven mind. It is again an information gathering tool. Similar to Car Seat, it is We've seen it active in 2025. Again,

sent via password protected files. Uh it is masqueraded as an interactive mind assessment desktop application while the user is busy with uh filling out this uh questions, it is silently profiling the host in the background. So, user thinks that they are filling a or doing a certificate and in the end, they will it will generate a PDF. It will create like a certificate of comp- completion. Uh again, this looks like just a normal uh certificate, but in the end, uh the collected information again as in CarSeat, the collected information is appended to this PDF file. Uh and again, it was um uh it was not visible to uh for any human visual verification. Uh what is interesting with this

RavenMind uh compared to uh CarSeat is it contains the hard-coded credentials to abuse Google Cloud uh infrastructure. So, it was possibly acting as a secondary beaconing or exfiltration uh channel. Or again, this does not have um it was also possibly came with the social engineering activity. So, it was expected probably uh by the target to send to the attacker. So, this is my last uh example from their uh malware inventory. I tried to give the same uh similar uh code families. Uh this is also information gathering tool as in CarSeat and RavenMind. Uh it is uh in this one is different. It is not generating any uh PDF file. Uh the target doesn't fill any forms or

doesn't take any test. Uh but, the target thinks that it is uh the target is busy with checking the photos, looking at the photos, but on the background again, it is as RavenMind and CarSeat, it is basically um profiling the system host. Uh what is interesting here is um this one since it's not generating anything, it has an exfiltration It is exfiltration channel. It sends all the collected data, encrypted collected data to the C2, which is on Cloudflare workers. But here comes their obs one the first obs failure. While their endpoint evasion logic was all clever and the thing, but their uh backend infrastructure administration administration suffered from a uh absolute breakdown. Uh Proxy photos uh

photo C2 architecture had a critical obs failure, if you ask me. Uh the Cloudflare script that is designed to get all this uh post data is uh echoing all this information that it got to the main page of the C2. So, what you see here is basically the the encrypted data of whoever ran this this malware. So, it might not mean anything for you for now, but since we know the AES key because it was hardcoded on the sample, so this when you get and it is like appended each time it runs. So, you have a huge like it's not overwritten, you have a huge list of all these things uh with the all this data blocks. Once you

get them, you can decrypt them with the hardcoded key and then what will you get get get is the the host names, the local IPs of their high-value targets. So, you can identify who they were targeting. What is worse, again another obs failure, we've also seen the staging IPs from themselves. So, they were also testing their malware by themselves by using their IPs. So, once you decrypt that, you will see their uh mostly VMs, but still you can see uh the the IP addresses from their sites. So, from this I'm stopping to tell about the code families, but more uh start to tell about the obs failures now they are doing. So, as we track their dedicated

we got more and more uh stuff. So, Great Caspian frequently used uh deployed their custom C2 C2 applications using the Django web framework, but they have repeatedly failed to disable the Django debug mode. So, because of this, when a user attack when a user like an analyst or even the scanners, they if if they go for an unexpected uh URL path, uh they that will be immediately give you an a verbose error page instead of like a standard error page. Um so, for this one for this right side picture, uh this instant short link domain, that's um so, we pivoted to this domain from a domain that was delivering Frosty photo and Raven might uh malware. So, we had this domain that

was delivering Frosty photo and Raven might, and from this domain we pivoted to this instant short link. So, we wanted to request A, what is this page showing? And then, there was a JavaScript on this main page basically posting all this uh browser fingerprinting data to this specific uh URL that you are seeing there. And if you requested that URL, you will just end up with this nice Django error uh output page. Uh which was good because this is giving you so many things. It is giving you uh the admin paths that are unique. So, you can create uh rules based on that admin unique admin path string. Uh it is also showing you some uh unique

uh URI paths. It is also showing you the config uh file names that you can build up rules, and then basically get all these their C2 back end architecture. Other Obsec failures, if I need to tell about the other Obsec failures, first of all, I said that they are testing their samples on VTs. This allowed us to get more versions of their malware when they're developing. That what interesting thing was is they were also sending this files to the virus.total from their own staging IPs. So, we were able to get that their IPs sending that files. And if you don't know that code family, if it's anything, we could say, "Hey, these are these guys. They are the same guys because

they're sending these files from the same IP." Second, they were using the AES keys. I said that they are sharing it. They're reusing the AES keys. We have like a set of keys that they were reusing. So, this was first of all again giving us an attribution case. Plus, if you end up another domain that is hosting huge encrypted data block from them, you could just get, even though if you don't have the malware that is basically using that as a C2, you would get that information decrypted because there were so many cases that they were they were using the same key over and over again. So, if you try, you might get lucky and then get that decrypted

data. Third one, they were they were not really isolating their network infrastructure. They were hosting, delivering, or controlling the multiple distinct malware families from the same C2. So, we had I told you that we had this domain that was delivering Frosty Photon and Raven Mind malware, but at the that domain was also used by another code family as a C2 to to communicate. So, they were not really isolating all their network infrastructure. Uh they reused a small cluster of personas. They used the same personas for their social engineering lures as recruiter personas. And the same users were also seen to register new domains. So, basically, you were we were able to connect the the fishing attack,

uh the persona, and the C2. It's all these together to just to to the group. They failed to to strip their PDB path, which gave us unique strings about their project IDs or usernames. Um they were really unique ones that we just build a build a rule about that and got so many files from the VT when they're testing their samples. Um As I said, they were also hosting and delivering also to the targets some of their malwares from the open directories. And in one case, even in one case, we've seen a log file hosted on the open directory just to show that who is checking who is making a request to that open directory. So, they were

also aware that they were being tracked and then they wanted to check who is logging in, but we were also able to see what they are doing at the same time. So, if we need to summarize, let me wrap up what I've already told about Great Caspian. It is a long-running threat actor, not really well tracked. As I said, this is the first public um talk about them. Uh and it remains a dangerous threat because they understand that instead of making all these loud uh, network traffic or um, uh, operations, the the long-term social engineering and uh, rapport building can be really reliable uh, to exploit the human. And also like with all these job applications lures, the

humans are more um, sorry. Humans are more um, okay to give their information. So, who doesn't want a job from a nice company that's like from a global nice company. Um, they're also actively adapting. When I talked about their change from being super loudy and then where they change more like uh, building uh, and developing new malware stuff, tracking who tracked them. Uh, they're also aware that they're being tracked, so they're evolving. Um, and then they're also moving more like to the uh, to the living off the cloud architectures to uh, await long-term uh, rule tracking. So, what can we do as defenders? I gave three uh, uh, examples about three uh, malware families, but I said that that we

at least we know at least 13 vectors, not vectors, 13 code families. From them, uh, so the best way is to get the text signatures for that uh, code families. And second, uh, basically uh, corporate security policy must strictly vet outreach from uh, unusual external personnel. Um, and if you ever receive like you have to vet the recruiter, the recruitment personnel that you have reached by. And also um, if you were asked if they were if the target asked to um, basically install a completely unique and uh, unknown application to just build a simple application. What like We have all CVs, we have all LinkedIn profiles now. Like it isn't it strange if you receive from someone, "Hey, just

just just run this and then build your own like CV that fits to our corporate policies." Just this just doesn't make sense. It should be like as a considered as a red flag. And also we we need rules that inspect inbound and outbound PDF traffic like with anomaly sized metadata anomaly metadata sized PDFs that might contain these microscopic fonts that if we just pay attention to that, we have this uh uh chance of mitigating Great Caspian. So this concludes my talk. Thank you. If you have any questions, I am ready or and happy to answer. If not, I'm around. OKAY. AND THIS IS THE FEEDBACK LINK IF anyone wants to give feedback. I would like to

see that. Yes. >> one question. I assume that they're probably not exfiltrating with data directly to servers based in Iran. Um just because that would frankly be a likely indicator. Um is Do you know where there are any indications as to where they're sending the data initially or retrieving it? >> Uh it it is not directly Iran or it doesn't need to be directly Iran, but that depends. But they were we were able to say that it is they were not sending the the the data to a shared server. So that was their big mistake. So if it was a shared server, we would be able to say that in an attribution base, we were also not

be able to say, "Hey, they are them." Or like Uh, it would not also be to track that C2, but they were not using a shared server, so it was like their own IP, but it was not located in Iran. It was in different locations. Okay, thank you, everyone. Thank