Source: OTX
Date: 2018-10-15 13:45:24
Threat actor: MuddyWater
Affected sector: Government
Attack vector: Phishing
Severity: High
Confidence: Low
MITRE ATT&CK techniques: T1566,T1071,T1053
File hash (FileHash-SHA256): 6c0111a1bdf8d766fe0aa28d96a5be204ab8deedd0f8e4a6148133219d0e3ddb
Description:
AlienVault has added additional indicators. MuddyWater is a relatively new APT that surfaced in 2017. It has focused mainly on governmental targets in Iraq and Saudi Arabia, according to past telemetry. However, the group behind MuddyWater has been known to target other countries in the Middle East, Europe and the US. We recently noticed a large amount of spear phishing documents that appear to be targeting government bodies, military entities, telcos and educational institutions in Jordan, Turkey, Azerbaijan and Pakistan, in addition to the continuous targeting of Iraq and Saudi Arabia, other victims were also detected in Mali, Austria, Russia, Iran and Bahrain.. These new documents have appeared throughout 2018 and escalated from May onwards. The attacks are still ongoing.
The new spear-phishing docs used by MuddyWater rely on social engineering to persuade users to enable macros. The attackers rely on a range of compromised hosts to deliver their attacks.