US Cyber Command Links ‘MuddyWater’ Hacking Group to Iranian Intelligence

The U.S. Cyber Command (USCYBERCOM) on Wednesday formally verified MuddyWater’s ties to the Iranian intelligence equipment, even though at the same time detailing the various instruments and techniques adopted by the espionage actor to burrow into sufferer networks.

“MuddyWater has been observed employing a wide variety of procedures to maintain entry to target networks,” USCYBERCOM’s Cyber National Mission Drive (CNMF) stated in a statement. “These include side-loading DLLs in purchase to trick authentic systems into running malware and obfuscating PowerShell scripts to cover command and handle functions.”

The agency characterized the hacking attempts as a subordinate aspect inside of the Iranian Ministry of Intelligence and Security (MOIS), corroborating earlier studies about the nation-state actor’s provenance.

Also tracked under the monikers Static Kitten, Seedworm, Mercury and TEMP.Zagros, MuddyWater is known for its attacks largely directed against a huge gamut of entities in governments, academia, cryptocurrency, telecommunications, and oil sectors in the Center East. The team is believed to have been active at least since 2017.

Modern intrusions mounted by the adversary have involved exploiting the ZeroLogon (CVE-2020-1472) vulnerability as very well as leveraging remote desktop administration applications such as ScreenConnect and Remote Utilities to deploy custom made backdoors that could help the attackers to gain unauthorized access to sensitive facts.

Very last month, Symantec’s Risk Hunter Team publicized findings about a new wave of hacking pursuits unleashed by the Muddywater group towards a string of telecom operators and IT throughout the Center East and Asia during the former 6 months using a blend of respectable resources, publicly accessible malware, and living-off-the-land (LotL) procedures.

Also integrated into its toolset is a backdoor named Mori and a piece of malware identified as PowGoop, a DLL loader made to decrypt and run a PowerShell-based script that establishes network communications with a distant server.

Malware samples attributed to the superior persistent danger (APT) have been designed available on the VirusTotal malware aggregation repository, which can be accessed here.

“Assessment of MuddyWater action suggests the group carries on to evolve and adapt their strategies,” SentinelOne researcher Amitai Ben Shushan Ehrlich claimed. “Although however relying on publicly readily available offensive security tools, the group has been refining its personalized toolset and utilizing new procedures to keep away from detection.”

Identified this article interesting? Comply with THN on Facebook, Twitter  and LinkedIn to examine additional unique information we write-up.

Some pieces of this report are sourced from:
thehackernews.com