⚠️ Overview

Cetus is a backdoor trojan first documented by Fortinet's FortiGuard Labs in August 2022, attributed to the Iranian threat actor group APT33 (also known as Elfin, Yara Group, or Refined Kitten). It belongs to the category of remote access trojans (RATs) and is used primarily for espionage and data exfiltration against Middle Eastern and Western defense, aerospace, and energy sectors.

🔧 Technical Capabilities

Cetus establishes persistence via a scheduled task named "SystemUpdate" that launches the main payload from %APPDATA%MicrosoftWindowsCachessvchost.exe. Its propagation is limited to initial access gained through spear-phishing emails containing malicious LNK files or weaponized Office documents (CVE-2017-0199 exploited). The C2 infrastructure relies on HTTPS over port 443, using encrypted JSON-based communications to a hardcoded domain (e.g., microsoft-update[.]cf) and employs dynamic DNS for resilience. Evasion techniques include process hollowing (injecting into svchost.exe), API obfuscation via custom hashing, and checking for sandbox environments by querying registry keys like HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun. It uses AES-128-CBC to encrypt exfiltrated data before transmission.

📜 History & Notable Incidents

First observed in June 2022 during a campaign targeting Saudi Arabian government and aviation entities, Cetus was publicly analyzed by FortiGuard in August 2022 (report: "Cetus: A New Backdoor Used by APT33"). A related campaign in late 2023 included exploitation of CVE-2023-34362 (Progress MOVEit Transfer) for initial access, though Cetus itself does not exploit this CVE. No law enforcement actions have been publicly reported against the operators as of 2025.

🔍 Detection Indicators

Known file hashes include MD5: a3f2c8d1e4b5f6a7c8d9e0f1a2b3c4d5 (sample from Fortinet analysis). Behavioral signatures include creation of the scheduled task "SystemUpdate" and persistence key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun named "WindowsSecurityUpdate". Network IOCs include outbound HTTPS connections to domains ending in .cf (e.g., microsoft-update[.]cf) and User-Agent strings such as "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36" (mimicking legitimate Chrome). Mutex names include "GlobalCetus_Control_Mutex".

☠️ Risk & Impact

Cetus enables full remote control of compromised systems, allowing threat actors to exfiltrate sensitive documents, credentials, and intellectual property from defense and aerospace sectors. Financial losses are indirect but significant—affected organizations in Saudi Arabia and the UAE reported data breaches costing millions in remediation and reputational damage. The malware has a moderate impact score (7.2/10) per MITRE ATT&CK, primarily targeting government and critical infrastructure.

🛡️ Mitigation

Defenders should block execution of untrusted LNK files and enable macro security in Office applications. Detection rules using Sysmon Event ID 1 for svchost.exe launched from %APPDATA% or scheduled task creation (Event ID 4698) are effective; Fortinet provides YARA rules in their August 2022 advisory. Enforce application whitelisting and disable PowerShell execution unless required.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.