For more than five years, Iran has maintained a reputation as one of the most aggressive nations in the global arena of state-sponsored hacking, stealing data from corporate and government networks around the world, bombarding US banks with cyberattacks, and most brazen of all, unleashing multiple waves of computer-crippling malware that hit tens of thousands of PCs across the Middle East. But amidst that noisy mayhem, one Iranian group has managed to quietly penetrate a broad series of targets around the world, until now evading the public eye. And while that group seems to have stuck to traditional spying so far, it may also be laying the groundwork for the next round of destructive attacks.

Security firm FireEye has released new research into a group it calls Advanced Persistent Threat 33, attributing a prolific series of breaches of companies in the aerospace, defense, and petrochemical industries in countries as wide-ranging as Saudi Arabia, South Korea, and the US. While FireEye has closely tracked APT33 since May of last year, the security firm believes the group has been active since at least 2013, with firm evidence that it works on behalf of Iran's government. And though FireEye describes APT33's activities as largely focused on stealthy spying, they've also found links between it and a mysterious piece of data-destroying malware that security analysts have puzzled over since earlier this year.

"This could be an opportunity for us to recognize an actor while they’re still focused on classic espionage, before their mission becomes more aggressive," says John Hultquist, FireEye's director of intelligence analysis. He compares APT33 to Sandworm, a hacking operation FireEye discovered in 2014 and tied to Russia, which began with spying intrusions against NATO and Ukrainian targets before escalating to data-wiping attacks in 2015 and finally two sabotage attacks against the Ukrainian power grid. "We've seen them deploy destructive tools they haven’t used. We're looking at a team whose mission could change to disruption and destruction overnight."

FireEye says it's encountered signs of APT33 in six of its own clients' networks, but suspects far broader intrusions. For now, it says the group's attacks have focused on Iran's regional interests. Even the targets in the US and Korea, for instance, have comprised companies with Middle East ties, though FireEye declines to name any specific targets. "They’re hitting companies headquartered all over the world," Hultquist says. "But they’re being swept up into this activity because they do business in the Gulf."

Seeds of Destruction

Beyond run-of-the-mill economic espionage, FireEye has found infections of victim networks with a specific piece of "dropper" malware—a piece of software designed to deliver one or multiple other malware payloads—that the security firm calls DropShot. That dropper had in some cases installed another malware weapon, which FireEye calls ShapeShift, designed to wipe target computers by overwriting every portion of a computer's hard drive with zeros.

While FireEye did not find that destructive malware in networks where it had identified APT33 hackers, it did find the same dropper used in APT33's intrusions to install a piece of backdoor software it called TurnedUp. It has also never seen the DropShot dropper used by another distinct hacker group, or distributed publicly.

The notion that Iranian hackers may be prepping another round of destructive attacks would hardly represent a break from form. In 2012, Iran-linked hackers calling themselves "Cutting Sword of Justice" used a piece of similar "wiper" malware known as Shamoon to overwrite the hard drives of 30,000 computers at Saudi oil behemoth Saudi Aramco with the image of a burning US flag. The same year, a group calling itself the Izz ad-Din al-Qassam Cyber Fighters took credit for an unrelenting series of distributed denial of service attacks on US banking sites known as Operation Ababil, purportedly in revenge for the anti-Muslim YouTube video "the Innocence of Muslims". Those attacks, too, were eventually pinned on Iran. And last year another round of Shamoon attacks ripped through the Middle East, destroying thousands more machines, this time overwriting the drives with the image of the body of a 3-year-old Syrian refugee who drowned in the Mediterranean.

Security firm Kaspersky first spotted ShapeShift in March of this year, calling it StoneDrill. Kaspersky noted that it resembles Shamoon, but with more techniques designed to evade security mechanisms, like the "sandbox" protections that limit a given application's access to the rest of a target computer. Kaspersky wrote at the time that one of the two targets in which it found StoneDrill malware was European, whereas Shamoon's attacks had been confined to the Middle East. "Why is this worrying?" asked Kaspersky founder Eugene Kaspersky in a blog post about the discovery. "Because this finding indicates that certain malicious actors armed with devastating cyber-tools are testing the water in regions in which previously actors of this type were rarely interested."