Operation Quicksand: MuddyWater's Attacks to Israeli Organizations

MuddyWaterQuicksand

During September 2020, identified a new campaign targeting many prominent Israeli organizations was identified. The campaign was attributed to the Iranian threat actor ‘MuddyWater’ (also known as TEMP.Zagros, Static Kitten and Seedworm).

Indicators of Compromise

Domains (1215)

brucel.rublockpost.websitebitsbitsd.spaceadblocked.spaceautumnale.xyzbrontaga.rucalendas.ruaradewa.rubobotal.rubombinator.xyzadmin-gmail.onlinebetsuno.ruanisoptera.onlinecanadensis.websitebrevisi.ruartisola.ruburuncha.ruacaciana.xyzalibetar.ruanisoptera.ru+1195 more

Hashes (2230)

6efdc5392d11ee5f4de7c1702faf89a0de891437a0ccee1f048d05ed3cc1d880747fbc85901d519c93cde42db42203dcc24aa5b09eb35f8313b9f98f89a14cdc625ed01fd1f2dc43b3c2492956fddc682aca3f793fac83e2d0dc7def10f68db0e5b00180324a73020f9b890c3ee620a318c537b62a7c37dcd051615f9983bcfbea17cdb1f24ce8e6679893049ce4e5a03bc2d8c7e44bf5b918bf8bf1c2e45c5de4d11e5696dce028459cf26be5816b14c6b1448456e716156d02c7e439d87318a79028df21966155675a407ba199561cf245e9e2858026bf7166a0f74a4b7bf4ae9d3307454ad504aff14bb089cb4089243e1a5ed325bdc225325dc4b8dcf3711e628d08854e97c49cfb904c0816129ed1d432c6bfff576b8c643aa43cbc53287ea515be67fa51be2bdb4132415003867fdd4eef299ca9de3d31fe4179ac61cf159dc3d987e6f1164a3da00ea80e45cc1fdc73d30cb0dff888e011b97d06e6752fb80c69ab7ecb6f2f3928c947bdd8d9e52a083856b9c644f240a6691e7b71065c142895a78d3c1bc2c321a2c41d8ae6ec402c2094ab5b2530c263a4b5c8c25b83d5e0ab0fa47bd9+2210 more

IPv4 (2537)

159.48.53.178194.67.108.168187.94.189.20147.182.169.247208.96.98.111118.249.53.26159.48.53.201178.46.94.132207.138.197.169185.191.215.7128.75.141.161123.240.37.7331.40.251.171178.184.187.100194.58.111.54168.100.10.129183.89.78.52193.243.156.212109.201.34.230116.48.6.22+2517 more

CVEs (10)

CVE-2020-1472CVE-2022-47633CVE-2017-0199CVE-2020-0688CVE-2018-13379CVE-2021-45608CVE-2021-45046CVE-2022-45359CVE-2017-0213CVE-2021-44228

Emails (11)

[email protected][email protected][email protected][email protected][email protected][email protected][email protected][email protected][email protected][email protected][email protected]

APT Groups

MuddyWater

Iran, Islamic Republic of

Notes

<div>MITRE ATT&CK Techniques Used by the MuddyWater APT Group Reconnaissance<ul><li>T1589.002 Gather Victim Identity Information: Email Addresses</li></ul> Resource Development<ul><li>T1583.006 Acquire Infrastructure: Web Services</li><li>T1588.002 Obtain Capabilities: Tool</li></ul> Initial Access<ul><li>T1566.001 Phishing: Spearphishing Attachment</li><li>T1566.002 Phishing: Spearphishing Link</li></ul> Execution<ul><li>T1047 Windows Management Instrumentation</li><li>T1059.001 Command and Scripting Interpreter: PowerShell</li><li>T1059.003 Command and Scripting Interpreter: Windows Command Shell</li><li>T1059.005 Command and Scripting Interpreter: Visual Basic</li><li>T1059.006 Command and Scripting Interpreter: Python</li><li>T1059.007 Command and Scripting Interpreter: JavaScript</li><li>T1203 Exploitation for Client Execution</li><li>T1204.001 User Execution: Malicious Link</li><li>T1204.002 User Execution: Malicious File</li><li>T1559.001 Inter-Process Communication: Component Object Model</li><li>T1559.002 Inter-Process Communication: Dynamic Data Exchange</li></ul> Persistence<ul><li>T1053.005 Scheduled Task/Job: Scheduled Task</li><li>T1137.001 Office Application Startup: Office Template Macros</li><li>T1543.003 Create or Modify System Process: Windows Service</li><li>T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder</li><li>T1547.005 Boot or Logon Autostart Execution: Security Support Provider</li></ul> Privilege Escalation<ul><li>T1134 Access Token Manipulation</li><li>T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control </li><li>T1555 Credentials from Password Stores</li><li>T1555.003 Credentials from Web Browsers</li></ul> Defense Evasion<ul><li>T1027 Obfuscated Files or Information</li><li>T1027.003 Steganography</li><li>T1027.004 Compile After Delivery</li><li>T1027.005 Obfuscated Files or Information: Indicator Removal from Tools</li><li>T1036.005 Masquerading: Match Legitimate Name or Location</li><li>T1055.001 Process Injection: Dynamic-link Library Injection</li><li>T1055.002 Process Injection: Portable Executable Injection</li><li>T1140 Deobfuscate/Decode Files or Information</li><li>T1218.003 Signed Binary Proxy Execution: CMSTP</li><li>T1218.005 Signed Binary Proxy Execution: Mshta</li><li>T1218.011 Signed Binary Proxy Execution: Rundll32</li><li>T1480 Execution Guardrails</li><li>T1562.001 Impair Defenses: Disable or Modify Tools</li><li>T1574.001 Hijack Execution Flow: DLL Search Order Hijacking</li><li>T1574.002 Hijack Execution Flow: DLL Side-Loading</li><li>T1574.007 Hijack Execution Flow: Path Interception by PATH Environment Variable</li><li>T1574.008 Hijack Execution Flow: Path Interception by Search Order Hijacking</li><li>T1574.009 Hijack Execution Flow: Path Interception by Unquoted Path</li></ul> Credential Access<ul><li>T1003.001 OS Credential Dumping: LSASS Memory</li><li>T1003.004 OS Credential Dumping: LSA Secrets</li><li>T1003.005 OS Credential Dumping: Cached Domain Credentials</li><li>T1552.001 Unsecured Credentials: Credentials In Files</li><li>T1552.002 Unsecured Credentials: Credentials in Registry</li><li>T1552.006 Unsecured Credentials: Group Policy Preferences,</li><li>T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting</li></ul> Discovery<ul><li>T1005 Data from Local System</li><li>T1012 Query Registry</li><li>T1016 System Network Configuration Discovery</li><li>T1033 System Owner/User Discovery</li><li>T1049 System Network Connections Discovery</li><li>T1057 Process Discovery</li><li>T1082 System Information Discovery</li><li>T1083 File and Directory Discovery</li><li>T1087.002 Account Discovery: Domain Account</li><li>T1482 Domain Trust Discovery</li><li>T1518 Software Discovery</li><li>T1518.001 Security Software Discovery</li></ul> Collection<ul><li>T1056.001 Input Capture: Keylogging</li><li>T1113 Screen Capture</li><li>T1123 Audio Capture</li><li>T1560.001 Archive Collected Data: Archive via Utility</li></ul> Command and Control<ul><li>T1071.001 Application Layer Protocol: Web Protocols</li><li>T1090.002 Proxy: External Proxy</li><li>T1102.002 Web Service: Bidirectional Communication</li><li>T1104 Multi-Stage Channels</li><li>T1105 Ingress Tool Transfer</li><li>T1132.001 Data Encoding: Standard Encoding</li><li>T1132.002 Data Encoding: Non-Standard Encoding</li><li>T1219 Remote Access Software</li><li>T1572 Protocol Tunneling</li></ul> Exfiltration<ul><li>T1041 Exfiltration Over C2 Channely</li></ul><div> </div></div><div>Security Recommendations Against MuddyWater </div><div><ul><li>MuddyWater leverages spear phishing. Provide necessary training to your employees for security awareness. </li><li>Gain visibility into external-facing digital assets with an Attack Surface Management solution. </li><li>Regularly apply security patches and software updates. </li><li>Apply the least privilege principle across the network, especially to critical systems and services </li><li>Secure domain controllers (DC) using best practices. </li><li>Enable multifactor authentication (MFA) to prevent lateral movement. </li><li>Refer to IOCs and take necessary actions toward mitigation. </li></ul></div>

Mitigation

Up-to-date backups are the most effective way of recovering from a ransomware attack; you should do the following, as N.C.S.C. suggests.<ul style="color: rgb(14, 16, 26); background: transparent; margin-top:0pt; margin-bottom:0pt;"><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Make regular backups of your most important files, which will be different for every organization, and check that you know how to restore files from the backup, and regularly test that it is working as expected.</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Ensure you create offline backups that are kept separate, in a different location (ideally offsite), from your network and systems, or in a cloud service designed for this purpose, as ransomware actively targets backups to increase the likelihood of payment. Our blog on 'Offline backups in an online world' provides additional advice for organizations.</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Make multiple copies of files using different backup solutions and storage locations. It would be best if you didn't rely on having two copies on a single removable drive, nor should you rely on multiple documents in a single cloud service.</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Ensure that your backup devices (such as external hard drives and USB sticks) are not permanently connected to your network. Attackers will target connected backup devices and solutions to make recovery more complex.</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">You should ensure that your cloud service protects previous backup versions from being immediately deleted and allows you to restore them. This will prevent your live and backup data from becoming inaccessible - cloud services often automatically synchronize directly after your files have been replaced with encrypted copies.</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Ensure that backups are only connected to known clean devices before starting recovery.</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Scan backups for malware before you restore files. Ransomware may have infiltrated your network over time and replicated to backups before being discovered.</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Regularly patch products used for backup so attackers cannot exploit any known vulnerabilities they might contain.</li></ul> You can reduce the likelihood of malicious content reaching your devices through a combination of the following:<ul style="color: rgb(14, 16, 26); background: transparent; margin-top:0pt; margin-bottom:0pt;"><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">filtering to only allow file types you would expect to receive</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">blocking websites that are known to be malicious</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">actively inspecting the content</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">using signatures to block known malicious code</li></ul> Prevent malware from spreading across organization action by following N.C.S.C. guidance to prevent lateral movement. You should also:<ul style="color: rgb(14, 16, 26); background: transparent; margin-top:0pt; margin-bottom:0pt;"><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Use M.F.A. to authenticate users so that if malware steals credentials, they can't easily be reused.</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Ensure obsolete platforms (Operating Systems (O.S.) and apps) are appropriately segregated from the rest of the network - refer to N.C.S.C. guidance on Obsolete Platforms for further details</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Regularly review and remove user permissions that are no longer required to limit the malware's ability to spread.</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Ensure system administrators avoid using their accounts for email and web browsing (to prevent malware from being able to run with their high level of system privilege)</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Practice good asset management, including keeping track of which versions of the software are installed on your devices so that you can target security updates quickly</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Keep devices and infrastructure patched, especially security-enforcing devices on the network boundary (such as firewalls and VPN products)</li></ul> A 'defense in depth' approach assumes that malware will reach your devices. You should therefore take steps to prevent malware from running. The measures required will vary for each device type, O.S., and version, but you should generally use device-level security features. Organizations should:<ul style="color: rgb(14, 16, 26); background: transparent; margin-top:0pt; margin-bottom:0pt;"><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Centrally manage devices to only permit applications trusted by the enterprise to run on machines, using technologies including AppLocker, or from trusted app stores (or other trusted locations)</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Consider whether enterprise antivirus or anti-malware products are necessary, and keep the software (and its definition files) up to date.</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Provide security education and awareness training to your people, for example, N.C.S.C.'s Top Tips for Staff.</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Disable or constrain scripting environments and macros by:</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Enforcing PowerShell Constrained Language mode via a User Mode Code Integrity</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Protecting your systems from malicious Microsoft Office macros</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Disable autorun for mounted media (prevent the use of removable media if it is not needed)</li></ul> In addition, attackers can force their code to execute by exploiting vulnerabilities in the device. Prevent this by keeping devices well-configured and up-to-date. We recommend that you:<ul style="color: rgb(14, 16, 26); background: transparent; margin-top:0pt; margin-bottom:0pt;"><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Install security updates as soon as they become available to fix exploitable bugs in your products</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Enable automatic updates for O.S.s, applications, and firmware if you can</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Use the latest versions of O.S.s and applications to take advantage of the latest security features</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Configure host-based and network firewalls, disallowing inbound connections by default</li></ul> Malware attacks, particularly ransomware attacks, can be devastating for organizations because computer systems are no longer available, and in some cases, data may never be recovered. It can take several weeks to recover if recovery is possible, but your corporate reputation and brand value could take much longer. The following will help to ensure your organization can recover quickly.<ul style="color: rgb(14, 16, 26); background: transparent; margin-top:0pt; margin-bottom:0pt;"><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Identify your critical assets and determine their impact if they were affected by a malware attack.</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Plan for an attack, even if you think it is unlikely. Many examples of organizations have been impacted by collateral malware, even though they were not the intended target.</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Develop an internal and external communication strategy. The correct information must reach the right stakeholders in a timely fashion.</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Determine how you will respond to the ransom demand and the threat of your organization's data being published.</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Ensure that incident management playbooks and supporting resources such as checklists and contact details are available if you cannot access your computer systems.</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Identify your legal obligations regarding reporting incidents to regulators, and understand how to approach this.</li><li style="background: transparent; margin-top: 0pt; margin-bottom: 0pt; list-style-type: disc;">Exercise your incident mangement plan. This helps clarify the roles and responsibilities of staff and third parties and to prioritize system recovery.</li></ul>After an incident, revise your incident management plan to include lessons learned to ensure that the same event cannot occur in the same way again.