Hacker Group ‘Moses Staff’ Using New StrifeWater RAT in Ransomware Attacks

A politically enthusiastic hacker team tied to a collection of espionage and sabotage attacks on Israeli entities in 2021 included a formerly undocumented distant accessibility trojan (RAT) that masquerades as the Windows Calculator app as component of a conscious energy to remain beneath the radar.

Cybersecurity organization Cybereason, which has been tracking the operations of the Iranian actor acknowledged as Moses Employees, dubbed the malware “StrifeWater.”

“The StrifeWater RAT appears to be employed in the initial phase of the attack and this stealthy RAT has the ability to remove by itself from the process to go over the Iranian group’s tracks,” Tom Fakterman, Cybereason security analyst, stated in a report. “The RAT possesses other capabilities, these kinds of as command execution and display capturing, as properly as the potential to obtain additional extensions.”

Moses Staff members came to light-weight toward the close of final yr when Look at Point Investigation unmasked a series of attacks aimed at Israeli corporations considering that September 2021 with the aim of disrupting the target’s enterprise functions by encrypting their networks, with no choice to regain entry or negotiate a ransom.

The intrusions were noteworthy for the fact that they relied on the open up-source library DiskCryptor to complete volume encryption, in addition to infecting the programs with a bootloader that stops them from starting without the appropriate encryption crucial.

To date, victims have been claimed outside of Israel, which include Italy, India, Germany, Chile, Turkey, the U.A.E., and the U.S.

The new piece of the attack puzzle discovered by Cybereason will come in the form of a RAT which is deployed under the name “calc.exe” (the Windows Calculator binary) and is made use of for the duration of the early levels of the infection chain, only to be removed prior to the deployment of the file-encrypting malware.

The removing and the subsequent substitution of the malicious calculator executable with the legit binary, the scientists suspect, is an try on the part of the threat actor to cover up tracks and erase evidence of the trojan, not to mention allow them to evade detection right up until the last section of the attack when the ransomware payload is executed.

StrifeWater, for its aspect, is no diverse from its counterparts and will come with several functions, chief amongst them remaining the capability to listing technique data files, execute process instructions, take monitor captures, produce persistence, and download updates and auxiliary modules.

“The conclude purpose for Moses Team seems to be a lot more politically motivated rather than economical,” Fakterman concluded. “Moses Staff employs ransomware write-up-exfiltration not for monetary acquire, but to disrupt functions, obfuscate espionage action, and to inflict hurt to techniques to progress Iran’s geopolitical targets.”

Observed this report intriguing? Observe THN on Fb, Twitter  and LinkedIn to examine far more exclusive content material we post.

Some areas of this posting are sourced from:
thehackernews.com