MuddyWater campaign against Turkish government entities

Cisco Talos published its analysis on 31 January 2022. It describes a campaign that ran as recently as November 2021 and that Talos attributes with high confidence to the MuddyWater group profile. Targets were Turkish government entities, including the Scientific and Technological Research Council of Turkey (TÜBİTAK).

Victims met the chain as a PDF with an embedded link. Talos does not describe the emails, but judges from earlier MuddyWater campaigns that spear-phishing was highly likely the route. The PDF showed an error message and asked the reader to click to fix the document format. At least two PDFs shared the author name “nejla” in their metadata.

The link led to an Excel file or a Windows executable, stored on snapfile[.]org. The Excel files had Turkish names, and some posed as documents from the Turkish Health and Interior Ministries. One was called Teklif_form_onaylı.xls, which means “Offer form approved”.

Talos saw a similar chain against a telecom provider in Armenia in June 2021 and against Pakistani entities in August 2021. It could not say whether the Turkish activity continues the Pakistan work. Server addresses used by the campaign also appeared in a Turkish threat advisory from September 2021. Trakya University and the national response center USOM shared it, and it warned of an APT-level email attack.

US documents cover the same period. Advisory AA22-055A, from 24 February 2022, describes MuddyWater’s methods in general and does not name Turkey. On 9 September 2022 the US Treasury said MuddyWater was assessed to be involved, as recently as November 2021, in a campaign against Turkish government entities. It said malware-laden documents, likely sent by spear-phishing email, were used to gain access to victims’ systems.

Delivery chain seen by Talos

1. A PDF with an embedded link reaches the target. It shows a fake error and asks the user to click to fix the file format.
2. The link downloads a second stage from snapfile[.]org or a similar sharing site. It is either an Excel file with macros or a Windows executable.
3. In the Excel path, the macro creates a Registry Run key, a Visual Basic script and a PowerShell downloader. The script then starts the downloader.
4. In the executable path, the file saves a decoy document in the temp folder and opens it. It then drops two dot-prefixed PowerShell scripts, named .CloudCache.conf and .CloudDrive.conf, in a folder in the user's home directory, and sets a Run key (in Talos's example, CloudDrive).
5. The downloader fetches the next PowerShell stage from a hardcoded server address. Talos could not obtain that final stage.

Details that help detection

• Persistence is an HKCU Run key. It starts the script through built-in Windows files: pcwutl.dll for the VBScript, or SyncAppvPublishingServer.vbs for PowerShell.
• Early Excel files held plain PowerShell in the comments field and metadata. Later versions obfuscate it.
• The macro sends two requests to canarytokens[.]com. Talos says this tells the operator the file was opened. It may also be an anti-sandbox check, because the payload server may release the payload only after receiving both almost simultaneously.
• The downloader tries twice with a 40-second timeout and a custom user agent that can carry the user name.

Tools named in AA22-055A

The advisory describes MuddyWater in general. It names PowGoop, Small Sieve, Canopy, Mori and POWERSTATS, and the exploited flaws CVE-2020-1472 (Netlogon) and CVE-2020-0688 (Exchange). Talos does not tie these tools to the Turkish campaign. It describes VBA, VBS and PowerShell downloaders instead.

ATT&CK techniques

Talos gives no technique IDs. The mapping below is ours: each ID is one that AA22-055A Table 1 (ATT&CK v10) also lists for MuddyWater, matched to what Talos observed.

• T1566.001 and T1566.002, Phishing: PDF lures with links, likely sent by email. See Phishing (T1566).
• T1204.001 and T1204.002, User Execution: the target must click the link and open the Excel file or run the executable. See User Execution (T1204).
• T1059.005 and T1059.001, Visual Basic and PowerShell: VBA macros, VBS and PS1 downloaders. See Command and Scripting Interpreter (T1059).
• T1547.001, Registry Run Keys: the HKCU Run value. See Registry Run Keys (T1547.001).
• T1027, Obfuscated Files or Information: obfuscated PowerShell in document comments. See Obfuscated Files or Information (T1027).
• T1105, Ingress Tool Transfer: the downloader fetches the next stage. See Ingress Tool Transfer (T1105).
• T1071.001, Web Protocols: HTTP requests to the sharing site, canary tokens and servers. See Application Layer Protocol (T1071).

Two behaviors Talos describes are not in the advisory table. Running PowerShell through SyncAppvPublishingServer.vbs is, in our mapping, T1216.002. The canary token timing checks may be sandbox evasion (T1497), but Talos only says they may be.

Talos names TÜBİTAK among the targets. It does not say that any target was breached, and it reports no stolen data or counts. Talos could not obtain the final payload, so what the operators did after the first foothold is not public.

The Treasury release names no Turkish body and reports no losses. Both sources show intent and method. Neither shows damage.

Talos published indicators of compromise: about 30 file hashes, command server addresses, download URLs, canary token identifiers and sender addresses. It also listed Snort rule IDs 58929 to 58938 and OSquery hunts, and thanked Canary Tools for its help in listing the tokens the group had created.

The September 2021 Turkish advisory listed server addresses that the campaign also used, so it could have served as an earlier warning. The US response came later. Advisory AA22-055A gave detection and mitigation steps on 24 February 2022, and on 9 September 2022 Treasury sanctioned the Ministry of Intelligence and Security and its minister. Neither source quotes a Turkish authority on the November 2021 campaign itself.