MuddyWater is an Iranian state-backed threat group that MITRE ATT&CK assesses to be part of Iran’s Ministry of Intelligence and Security. A new campaign associated with the group targets Turkey and the Arabian Peninsula. It uses phishing emails to deliver the SloughRAT (Canopy) trojan, a remote access trojan that runs commands from command and control servers.
What is the new MuddyWater campaign?
Iranian state-backed MuddyWater threat actors have been associated with a new offensive campaign targeting Turkey and the Arabian Peninsula to plant remote access trojans (RATs) on compromised systems.
How does the SloughRAT infection chain work?
The chain of attacks begins with sending phishing e-mails containing malicious attachments to the recipients to distribute the SloughRAT (Canopy) trojan, which is responsible for executing commands received from command and control servers (C&C). The malicious document sent by the phishing e-mail contains a malicious macro that drops two WSF (Windows Script File) files on the target system. One of these scripts is used to execute the next phase and is placed in the current user’s Startup folder by a VBA macro to ensure persistence between reboots. The second script contains the “SloughRAT” malware, which will be used to execute arbitrary commands on the target system. This RAT consists of hidden Visual Basic and JavaScript code. After a series of malicious activities are carried out through malware, the data and results captured are transferred to C&C servers.
Is this campaign linked to earlier MuddyWater activity?
It has been determined that the campaign is a continuation of the November 2021 MuddyWater campaign, which targets Turkish private and government institutions with PowerShell-based backdoors for information gathering and espionage activities.
How can you protect against MuddyWater phishing campaigns?
To not be the target of this and similar malware campaigns, it is important to ignore e-mail attachments and links from unknown people, not to download files or programs from unknown sources, and conduct attack surface analyses at regular intervals. Also, It is recommended to raise awareness of institution/organization personnel against possible phishing / social engineering attacks and block detected IoC findings related to the campaign from security devices in use.