APT Profile – MUDDYWATER

MuddyWater is an APT group assessed to be affiliated to the Iranian Government, that targets victims in the Middle East with in-memory vectors leveraging on PowerShell, in a family of attacks now identified as “Living off the land”, as they don’t require the creation of new binaries on the victim’s machine, thus maintaining a low detection profile and a low forensic footprint. The operators behind MuddyWater are likely espionage motivated. Despite the strong preponderance of victims from Pakistan, the most active targets appear to be in Saudi Arabia, the UAE, and Iraq.

Alias:
MERCURY, Seedworm, Static Kitten, TEMP.Zagros, Earth Vetala

Motivation:
Information theft and espionage

Target Technologies:
Office Suites Software, Operating System, Web Application

Targeted Industries:
Aerospace, Aerospace & Defense, Agriculture, Capital Goods, Consumer Services, Defense, Energy, Energy Equipment & Services, Finance, Food, Gaming, High Tech IT Service Providers, Individuals, Media, Media & Entertainment, Military, NGO, Natural Resources, Oil and Gas, Politics, Telecommunication, Telecommunication Services, Transportation, Construction, Cryptocurrency, Education, Engineering, Government, Healthcare, and Metals

Targeted Countries
Israel, Saudi Arabia, the United Arab Emirates, Iraq, Jordan, Lebanon, Qatar, Albania, Turkey, Austria, Ukraine, Russia, India, Azerbaijan, Pakistan, the United States of America, and Mali

Tools Used:
Secure Sockets Funneling , Remadmin , Chisel , Quarks pwDump , PowGoop (Downloader.Covic) , Mimikatz , POWERSTATS , PowGoop , Thanos ransomware

Recently Exploited Vulnerabilities by MUDDYWATER

MUDDYWATER’s Recent Campaign Highlights and Trends

• In a recent campaign, the MuddyWater threat group is believed to have targeted organizations in Saudi Arabia, Turkey, Azerbaijan, India, and Portugal. The attackers have been using compromised organizational email accounts to send phishing messages, primarily aimed at deploying legitimate remote management tools like Atera Agent and Screen Connect. These phishing campaigns, ongoing since February 2024, focus on various sectors, including government bodies, municipalities, media outlets, and travel agencies. So far, over 50 spear-phishing emails have been identified across more than ten sectors, each customized to lure specific targets into enabling remote access through legitimate software, which helps MuddyWater evade detection while maintaining persistent access.
• Since October 2024, MuddyWater has intensified its cyber operations against Israeli organizations. This increased activity is part of a broader campaign deploying a custom malware implant known as BugSleep. This new backdoor enables MuddyWater to execute remote commands and transfer files on compromised systems, representing a shift from their prior use of legitimate remote management tools like Atera Agent and Screen Connect. Designed for remote command execution and file transfer between infected systems and a command-and-control server, BugSleep is still under development, with continuous updates aimed at enhancing its functionality and evasion capabilities.

Malware used by MUDDYWATER: POWERSTATS MITRE ATT&CK Techniques used by MUDDYWATER