MuddyWater
BedrohungsakteurIRauch bekannt als
Weitere Namen und Kennungen dieser Entität.
ATT&CK
Earth Vetala · MERCURY · Mango Sandstorm · MuddyKrill · MuddyWater · Seedworm · Static Kitten · TA450 · TEMP.Zagros
MISP
ATK51 · Boggy Serpens · COBALT ULSTER · Earth Vetala · MERCURY · MUDDY ION · MUDDYCOAST · Mango Sandstorm · MuddyWater · Seedworm · Static Kitten · TA450 · TEMP.Zagros
The MuddyWater attacks are primarily against Middle Eastern nations. However, we have also observed attacks against surrounding nations and beyond, including targets in India and the USA. MuddyWater attacks are characterized by the use of a slowly evolving PowerShell-based first stage backdoor we call “POWERSTATS”. Despite broad scrutiny and reports on MuddyWater attacks, the activity continues with only incremental changes to the tools and techniques.
zugeordnete ATT&CK-Gruppen
Zugehörige Bedrohungsgruppen.
genutzte Techniken (68)
ATT&CK-Techniken, die dies ermöglicht oder abbildet.
genutzte Software (22)
Zugehörige Malware und Tools.
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://unit42.paloaltonetworks.com/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/
- https://www.cfr.org/interactive/cyber-operations/muddywater
- https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html
- https://blog.trendmicro.com/trendlabs-security-intelligence/campaign-possibly-connected-muddywater-surfaces-middle-east-central-asia/
- https://blog.trendmicro.com/trendlabs-security-intelligence/another-potential-muddywater-campaign-uses-powershell-based-prb-backdoor/
- https://securelist.com/muddywater/88059/
- https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group
- https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf