Rewterz Threat Alert – Recent Wave of Muddy Water Attacks

Severity

High

Analysis Summary

During October-November, the Iranian attack group MuddyWater carried out new attacks against several targets in the Middle East, mostly in Iraq. This group has been previously active in Israel and are known for infecting targets using DOC files and social engineering. In this attack wave, we identified for the first time a malware that is designed to attack in Iran by impersonating an international Iranian shipping company – Azim Tarabar. It is possible that the group also engages in internal espionage, in addition to its ongoing activities in the Middle East. The group began preparing the recent attack infrastructure on August 19. The infrastructure is built on hacked servers that were previously used to store code for the POWERSTATS malware, as well as new hacked servers, like a server by the Saudi firm KSA Hosting. Similar to the group’s previous activity, the group hacks into the servers almost always by penetrating into WordPress based open directories in order to plant the malware code.

Impact

Exposure of sensitive information

Indicators of Compromise

MD5

• 50ac74eb38d6fa07d9f5e788d61a92cd
• 66c783e41480e65e287081ff853cc737
• e18228bee6f1cf12eaf1bb4d5be587bf
• 9d0bfb81f450de8364327a4aaa67d9b3
• 5ef459908d5be0672b02cdfe4f606989
• 2c3a634953a9a2c227a51e8eeac9f137
• 269afae11cc9837e732019a03fa02fab
• 1cd71f39ff9fb3bf269440b63c717195
• 7ed6c5e8c3ec4f9499eb793d69a06758
• b9ee416f2d9557be692abf448bf2f937
• a9706c01de9364eab210ea73296bfe71
• 584479a1958a73720c4aebb52c59b21e
• 32156247f900883d5106795ec103a624
• 4022bbb9df5d86226bd9a89f361c94b9
• b100c0cfbe59fa66cbb75de65c505ce2
• 46f911014f1202e17936f627f34e6165

URL

• http[:]//graphixo[.]net/wp-includes/utf8[.]php
• http[:]//ksahosting[.]net/wp-includes/utf8[.]php
• http[:]//assignmenthelptoday[.]com/wp-includes/utf8[.]php
• https[:]//assignmenthelptoday[.]com/wp-includes/utf8[.]php
• https[:]//annapolisfirstlimo[.]com/editob[.]nvd

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the links/attachments sent by unknown senders.