Rewterz Threat Alert – Ursnif Found in Admin Billing Phishing Campaign
November 21, 2019Rewterz Threat Alert – TrickBot Trojan Ready to Steal OpenSSH and OpenVPN Keys
November 25, 2019Rewterz Threat Alert – Ursnif Found in Admin Billing Phishing Campaign
November 21, 2019Rewterz Threat Alert – TrickBot Trojan Ready to Steal OpenSSH and OpenVPN Keys
November 25, 2019Severity
High
Analysis Summary
During October-November, the Iranian attack group MuddyWater carried out new attacks against several targets in the Middle East, mostly in Iraq. This group has been previously active in Israel and are known for infecting targets using DOC files and social engineering. In this attack wave, we identified for the first time a malware that is designed to attack in Iran by impersonating an international Iranian shipping company – Azim Tarabar. It is possible that the group also engages in internal espionage, in addition to its ongoing activities in the Middle East. The group began preparing the recent attack infrastructure on August 19. The infrastructure is built on hacked servers that were previously used to store code for the POWERSTATS malware, as well as new hacked servers, like a server by the Saudi firm KSA Hosting. Similar to the group’s previous activity, the group hacks into the servers almost always by penetrating into WordPress based open directories in order to plant the malware code.
Impact
Exposure of sensitive information
Indicators of Compromise
MD5
- 50ac74eb38d6fa07d9f5e788d61a92cd
- 66c783e41480e65e287081ff853cc737
- e18228bee6f1cf12eaf1bb4d5be587bf
- 9d0bfb81f450de8364327a4aaa67d9b3
- 5ef459908d5be0672b02cdfe4f606989
- 2c3a634953a9a2c227a51e8eeac9f137
- 269afae11cc9837e732019a03fa02fab
- 1cd71f39ff9fb3bf269440b63c717195
- 7ed6c5e8c3ec4f9499eb793d69a06758
- b9ee416f2d9557be692abf448bf2f937
- a9706c01de9364eab210ea73296bfe71
- 584479a1958a73720c4aebb52c59b21e
- 32156247f900883d5106795ec103a624
- 4022bbb9df5d86226bd9a89f361c94b9
- b100c0cfbe59fa66cbb75de65c505ce2
- 46f911014f1202e17936f627f34e6165
URL
- http[:]//graphixo[.]net/wp-includes/utf8[.]php
- http[:]//ksahosting[.]net/wp-includes/utf8[.]php
- http[:]//assignmenthelptoday[.]com/wp-includes/utf8[.]php
- https[:]//assignmenthelptoday[.]com/wp-includes/utf8[.]php
- https[:]//annapolisfirstlimo[.]com/editob[.]nvd
Remediation
- Block all threat indicators at your respective controls.
- Always be suspicious about emails sent by unknown senders.
- Never click on the links/attachments sent by unknown senders.