The Iran-linked MuddyWater threat actor was found targeting several countries in the Middle East as well as Central and West Asia as part of a new spear-phishing activity.
Deep Instinct researcher Simon Kenin stated that the campaign has been observed targeting Armenia, Azerbaijan, Egypt, Iraq, Israel, Jordan, Oman, Qatar, Tajikistan, and the United Arab Emirates.
MuddyWater, also called Boggy Serpens, Cobalt Ulster, Earth Vetala, Mercury, Seedworm, Static Kitten, and TEMP.Zagros, is a subordinate element within Iran’s Ministry of Intelligence and Security (MOIS).
The group which has been active since at least 2017, usually targeted telecommunications, government, defense, and oil sectors.
MuddyWater used phishing lures that contain direct Dropbox links or document attachments with an embedded URL pointing to a ZIP archive file to target the victims.
The messages are sent from already compromised corporate email accounts, which are being offered for sale on the darknet by webmail shops like Xleet, Odin, Xmina, and Lufix anywhere between $8 to $25 per account.
While the archive files have previously harbored installers for legitimate tools like ScreenConnect and RemoteUtilities, the actor switched to Atera Agent in July 2022 in a bid to fly under the radar.
The integrated MSP software offers a way to completely control a machine, allowing the adversary to conduct reconnaissance, deploy additional backdoors, and even sell access to other actors.
The findings come as Deep Instinct also uncovered new malware components employed by a Lebanon-based group tracked as Polonium in its attacks aimed exclusively at Israeli entities.
Comments