During October-November, the Iranian attack group MuddyWater carried out new attacks against several targets in the Middle East, mostly in Iraq. This group has been previously active in Israel and are known for infecting targets using DOC files and social engineering. In this attack wave, we identified for the first time a malware that is designed to attack in Iran by impersonating an international Iranian shipping company – Azim Tarabar. It is possible that the group also engages in internal espionage, in addition to its ongoing activities in the Middle East. The group began preparing the recent attack infrastructure on August 19. The infrastructure is built on hacked servers that were previously used to store code for the POWERSTATS malware, as well as new hacked servers, like a server by the Saudi firm KSA Hosting. Similar to the group’s previous activity, the group hacks into the servers almost always by penetrating into WordPress based open directories in order to plant the malware code.
Exposure of sensitive information