MuddyWater
MuddyWater is an Iranian threat group that has primarily targeted Middle Eastern nations, and has also targeted European and North American nations. The group's victims are mainly in the telecommunications, government (IT services), and oil sectors. Activity from this group was previously linked to FIN7, but the group is believed to be a distinct group possibly motivated by espionage.[1][2][3][4][5]
Associated Group Descriptions
Name | Description |
---|---|
Seedworm | |
TEMP.Zagros |
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1548 | .002 | Abuse Elevation Control Mechanism: Bypass User Account Control |
MuddyWater uses various techniques to bypass UAC.[3] |
Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols |
MuddyWater has used HTTP for C2 communications.[4] |
Enterprise | T1560 | .001 | Archive Collected Data: Archive via Utility |
MuddyWater has used the native Windows cabinet creation tool, makecab.exe, likely to compress stolen data to be uploaded.[2] |
Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
MuddyWater has added Registry Run key |
Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
MuddyWater has used a custom tool for creating reverse shells.[2] MuddyWater has used JavaScript files to execute its POWERSTATS payload.[6][9][7][2][3] |
.001 | Command and Scripting Interpreter: PowerShell |
MuddyWater has used PowerShell for execution.[6][9][7][2][3][8][5] |
||
.005 | Command and Scripting Interpreter: Visual Basic |
MuddyWater has used VBScript files to execute its POWERSTATS payload, as well as macros.[6][9][7][2][3][4][5] |
||
Enterprise | T1555 | Credentials from Password Stores |
MuddyWater has performed credential dumping with LaZagne and other tools, including by dumping passwords saved in victim email.[1][2] |
|
.003 | Credentials from Web Browsers |
MuddyWater has run a tool that steals passwords saved in victim web browsers.[2] |
||
Enterprise | T1132 | .001 | Data Encoding: Standard Encoding |
MuddyWater has base64 encoded C2 communications.[4] |
Enterprise | T1140 | Deobfuscate/Decode Files or Information |
MuddyWater decoded base64-encoded PowerShell commands using a VBS file.[6][9][3] |
|
Enterprise | T1041 | Exfiltration Over C2 Channel |
MuddyWater has used C2 infrastructure to receive exfiltrated data.[5] |
|
Enterprise | T1203 | Exploitation for Client Execution |
MuddyWater has exploited the Office vulnerability CVE-2017-0199 for execution.[4] |
|
Enterprise | T1083 | File and Directory Discovery |
MuddyWater has used malware that checked if the ProgramData folder had folders or files with the keywords "Kasper," "Panda," or "ESET."[7] |
|
Enterprise | T1105 | Ingress Tool Transfer |
MuddyWater has used malware that can upload additional files to the victim’s machine.[7][3][5] |
|
Enterprise | T1559 | .002 | Inter-Process Communication: Dynamic Data Exchange |
MuddyWater has used malware that can execute PowerShell scripts via DDE.[7] |
.001 | Inter-Process Communication: Component Object Model |
MuddyWater has used malware that has the capability to execute malicious code via COM, DCOM, and Outlook.[7][4] |
||
Enterprise | T1036 | .005 | Masquerading: Match Legitimate Name or Location |
MuddyWater has used filenames and Registry key names associated with Windows Defender.[6][8] |
Enterprise | T1104 | Multi-Stage Channels |
MuddyWater has used one C2 to obtain enumeration scripts and monitor web logs, but a different C2 to send data back.[8] |
|
Enterprise | T1027 | Obfuscated Files or Information |
MuddyWater has used Daniel Bohannon’s Invoke-Obfuscation framework.[1][10] The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands.[1][6][7][8][4] |
|
.004 | Compile After Delivery |
MuddyWater has used the .NET csc.exe tool to compile executables from downloaded C# code.[3] |
||
.003 | Steganography |
MuddyWater has stored obfuscated JavaScript code in an image file named temp.jpg.[3] |
||
Enterprise | T1137 | .001 | Office Application Startup: Office Template Macros |
MuddyWater has used a Word Template, Normal.dotm, for persistence.[5] |
Enterprise | T1003 | .001 | OS Credential Dumping: LSASS Memory |
MuddyWater has performed credential dumping with Mimikatz.[1][2] |
.004 | OS Credential Dumping: LSA Secrets |
MuddyWater has performed credential dumping with LaZagne.[1][2] |
||
.005 | OS Credential Dumping: Cached Domain Credentials |
MuddyWater has performed credential dumping with LaZagne.[1][2] |
||
Enterprise | T1566 | .001 | Phishing: Spearphishing Attachment |
MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients.[1][6][7][4] |
Enterprise | T1057 | Process Discovery |
MuddyWater has used malware to obtain a list of running processes on the system.[7][4] |
|
Enterprise | T1090 | .002 | Proxy: External Proxy |
MuddyWater has controlled POWERSTATS from behind a proxy network to obfuscate the C2 location.[2] MuddyWater has used a series of compromised websites that victims connected to randomly to relay information to command and control (C2).[5] |
Enterprise | T1053 | .005 | Scheduled Task/Job: Scheduled Task |
MuddyWater has used scheduled tasks to establish persistence.[5] |
Enterprise | T1113 | Screen Capture |
MuddyWater has used malware that can capture screenshots of the victim’s machine.[7] |
|
Enterprise | T1218 | .011 | Signed Binary Proxy Execution: Rundll32 |
MuddyWater has used malware that leveraged rundll32.exe in a Registry Run key to execute a .dll.[7] |
.003 | Signed Binary Proxy Execution: CMSTP |
MuddyWater has used CMSTP.exe and a malicious INF to execute its POWERSTATS payload.[6] |
||
.005 | Signed Binary Proxy Execution: Mshta |
MuddyWater has used mshta.exe to execute its POWERSTATS payload and to pass a PowerShell one-liner for execution.[6][7] |
||
Enterprise | T1518 | .001 | Software Discovery: Security Software Discovery |
MuddyWater has used malware to check running processes against a hard-coded list of security tools often used by malware researchers.[7] |
Enterprise | T1082 | System Information Discovery |
MuddyWater has used malware that can collect the victim’s OS version and machine name.[7][8][5] |
|
Enterprise | T1016 | System Network Configuration Discovery |
MuddyWater has used malware to collect the victim’s IP address and domain name.[7] |
|
Enterprise | T1033 | System Owner/User Discovery |
MuddyWater has used malware that can collect the victim’s username.[7] |
|
Enterprise | T1552 | .001 | Unsecured Credentials: Credentials In Files |
MuddyWater has run a tool that steals passwords saved in victim email.[2] |
Enterprise | T1204 | .002 | User Execution: Malicious File |
MuddyWater has attempted to get users to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails.[1][6][7][8][4][5] |
Enterprise | T1047 | Windows Management Instrumentation |
MuddyWater has used malware that leveraged WMI for execution and querying host information.[7][3][8] |
Software
References
- Lancaster, T.. (2017, November 14). Muddying the Water: Targeted Attacks in the Middle East. Retrieved March 15, 2018.
- Symantec DeepSight Adversary Intelligence Team. (2018, December 10). Seedworm: Group Compromises Government Agencies, Oil & Gas, NGOs, Telecoms, and IT Firms. Retrieved December 14, 2018.
- ClearSky Cyber Security. (2018, November). MuddyWater Operations in Lebanon and Oman: Using an Israeli compromised domain for a two-stage campaign. Retrieved November 29, 2018.
- ClearSky. (2019, June). Iranian APT group ‘MuddyWater’ Adds Exploits to Their Arsenal. Retrieved May 14, 2020.
- Reaqta. (2017, November 22). A dive into MuddyWater APT targeting Middle-East. Retrieved May 18, 2020.
- Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018.
- Kaspersky Lab's Global Research & Analysis Team. (2018, October 10). MuddyWater expands operations. Retrieved November 2, 2018.
- Adamitis, D. et al. (2019, May 20). Recent MuddyWater-associated BlackWater campaign shows signs of new anti-detection techniques. Retrieved June 5, 2019.
- Villanueva, M., Co, M. (2018, June 14). Another Potential MuddyWater Campaign uses Powershell-based PRB-Backdoor. Retrieved July 3, 2018.
- Bohannon, D.. (2017, March 13). Invoke-Obfuscation - PowerShell Obfuscator. Retrieved June 18, 2017.
- Lunghi, D. and Horejsi, J.. (2019, June 10). MuddyWater Resurfaces, Uses Multi-Stage Backdoor POWERSTATS V3 and New Post-Exploitation Tools. Retrieved May 14, 2020.