• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – The Dustman Malware Hits Bahrain’s national oil company
January 9, 2020
Rewterz Threat Advisory – CVE-2019-16005 – Cisco Webex Video Mesh Node Command Injection Vulnerability
January 10, 2020

Rewterz Threat Alert – ZeroCleare Malware Debuts in Middle East Targeting Energy Sector

January 9, 2020

Severity

High

Analysis Summary

An overlapping attack activity carried by ITG013 (also known as “APT34” or “Oilrig”) and an unknown, probably Iranian cyber group targeting the energy sector in the Middle East. Further, it is assessed that access to at least one targeted environment was used to conduct a destructive attack using newly identified disk wiper malware, ZeroCleare. The attack timeline may have begun as early as Autumn of 2018 with reconnaissance scanning from various low cost/free VPN providers and gaining access to one of the accounts that was later involved in the attack. Then, in the Summer of 2019, the attackers used a password spray from a system on the local network to gain access to additional accounts, install ASPX webshells, and gain domain administration privileges. Finally, unknown actors spread a destructive wiper ZeroCleare across the target network and executed it. The ZeroCleare disk wiper malware had both x86 and x64 versions to execute across 32-bit and 64-bit operating systems. Interestingly, this malware incorporated the Eldos RawDisk driver, which was previously used in each of the Shamoon attacks, reportedly perpetrated by Iranian-linked threat actors.

Impact

Wipe out data from the infected host

Indicators of Compromise

IP

193[.]111[.]152[.]13

MD5

  • 33f98b613b331b49e272512274669844
  • 69b0cec55e4df899e649fa00c2979661
  • 1a69a02b0cd10b1764521fec4b7376c9
  • 993e9cb95301126debdea7dd66b9e121
  • 1ef610b1f9646063f96ad880aad9569d
  • eaea9ccb40c82af8f3867cd0f4dd5e9d

Remediation

  • Block all threat indicators at your respective controls.
  • Always be suspicious about emails sent by unknown senders.
  • Never click on the links/attachments sent by unknown senders.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.