Iranian linked conglomerate MuddyWater comprised of regionally focused subgroups

MITRE Techniques

• [T1059.001] PowerShell – Use of PowerShell to execute downloads and payloads. Quote: ‘PowerShell-based downloader malware.’
• [T1059.005] Visual Basic – VB-based implant (late 2021 – 2022) that downloads and runs arbitrary commands. Quote: ‘Visual Basic (VB) … downloads and runs arbitrary commands on the victim’s system.’
• [T1059.007] JavaScript – JavaScript-based implants (2019 – 2020) that download and run arbitrary commands. Quote: ‘one in JavaScript (2019 – 2020), which also downloads and runs arbitrary commands on the victim’s system.’
• [T1566.001] Phishing – Malicious documents (maldocs) used to deploy downloaders and RATs. Quote: ‘malicious documents (maldocs) to deploy downloaders and RATs’
• [T1021.001] Remote Services – Use of ConnectWise remote administration tool to gain initial foothold. Quote: ‘Connectwise Remote Administration tool’ (contextual mention of rapid access to targets).
• [T1047] Windows Management Instrumentation (WMI) – RAT begins by performing a WMI query to record the IP address of the infected endpoint. Quote: ‘The RAT script begins execution by performing a WMI query to record the IP address of the infected endpoint.’
• [T1071.001] Web Protocols – Initial contact with hosting servers is done via HTTP. Quote: ‘initial contact with hosting servers is done via HTTP.’
• [T1071.004] Application Layer Protocol: DNS – DNS used to contact C2 servers. Quote: ‘MuddyWater frequently relies on DNS to contact their C2 servers.’
• [T1547.001] Boot or Logon Autostart: Startup Folder – Persistence via the current user’s Startup folder. Quote: ‘Startup folder by the VBA macro to establish persistence across reboots.’
• [T1053.005] Scheduled Task – Malicious VB/VBScript-based downloaders leverage scheduled tasks. Quote: ‘malicious scheduled tasks’
• [T1027] Obfuscated/Compressed Files or Information – WSF RAT and related components are obfuscated to hide extensions. Quote: ‘The WSF implant has several capabilities. The script uses multilayer obfuscation to hide its true extensions.’
• [T1572] Protocol Tunneling – Use of Ligolo reverse-tunneling tool to gain control over endpoints. Quote: ‘The attackers utilized SloughRAT to deploy Ligolo, an open-source reverse-tunneling tool to gain a greater degree of control over the infected endpoints.’
• [T1041] Exfiltration Over C2 Channel – Data exfiltrated to and from the C2 via HTTP. Quote: ‘Any data sent to the C2 server is in the format of HTTP forms…’