Rewterz Threat Advisory – CVE-2021-44832 – Apache Log4j
December 29, 2021Rewterz Threat Alert – SmokeLoader Malware – Active IOCs
December 29, 2021Severity
High
Analysis Summary
The Iranian cybercriminal group MuddyWater has resurfaced. The group primarily has targeted Middle Eastern, European, and North American nations. The industries under target include telecommunications, government (IT services), and oil sectors. Most of the campaigns by MuddyWater are designed upon socially engineering their victims into enabling macros in order to infect the targeted workstation. Once macros were enabled, the threat actor-written code would attempt to obtain a trojan hosted on an adversarial payload command and control node.
Impact
- Credential Theft
- Exposure of Sensitive Information
Indicators of Compromise
Filename
- projectvpn[.]doc
IP
- 192[.]227[.]147[.]152
- 107[.]174[.]68[.]60
MD5
- c9ab403bd43649b5fd57efac4bf83b7c
- 748ae5af58e52e940ab806bdbbe61c4c
- 5c0db4b48129acc977e26de7daed6b49
SHA-256
- ea24c5a8b976919d4c8c4779dc0b7ef887373f126c4732edf9023b827b4e4dc4
- 2f2492b7bb55f7a12f7530c9973c9b81fdd5e24001e4a21528ff1d5b47e3446e
- 84d523833db6cc74a079b12312da775d4281bf1034b2af0203c9d14c098e6f29
SHA-1
- d3d98b066011fea2f4f1b9eaab97b28591d50fbe
- 202d003226eb71772701854af86e9e22eb41654f
- 2021c163c7fcae8f4941ea50247ae3fa3eb1dde9
Remediation
- Block all threat indicators at your respective controls.
- Search for ICOs in your environment.
- Always be suspicious about emails sent by unknown senders.
- Never click on the links/attachments sent by unknown senders