🇹🇷 Turkey🇵🇰 Pakistan🇦🇪 UAE🇮🇱 Israel🇮🇶 Iraq🇸🇦 Saudi Arabia
Overview
MuddyWater is an Iranian state-sponsored group linked to MOIS conducting espionage operations primarily against Middle Eastern, Central Asian, and Western government and telecommunications organizations. Known for heavy use of legitimate tools like Atera, ScreenConnect, and SimpleHelp for remote access, making detection difficult. The group frequently uses living-off-the-land techniques and spearphishing with macro-enabled documents.
Large-scale abuse of legitimate remote management tools for persistent access.
2022
PhonyC2 Deployment
Development and deployment of custom C2 framework replacing older tools.
2021
Log4j Exploitation
Rapid adoption of Log4j vulnerabilities for initial access against Israeli targets.
2018
POWERSTATS Campaign
Targeting of government organizations in the Middle East with custom PowerShell backdoor.
Detection Engineering
RMM Tool Abuse Detection
Maintain an inventory of approved RMM tools. Alert on installation of ScreenConnect, Atera, SimpleHelp, AnyDesk, or TeamViewer if not approved for that endpoint. Monitor for RMM agent communication to unexpected tenant IDs or account identifiers.
Monitor mshta.exe executing remote HTA files from URLs. Detect regsvr32.exe loading remote SCT files via /s /u /i:URL patterns. Alert on rundll32.exe with unusual command-line arguments. Enable Windows ASR rules for LOLBIN restriction.