{"id":16471,"date":"2022-02-25T02:44:06","date_gmt":"2022-02-25T02:44:06","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/25\/us-and-uk-warn-of-attacks-from-iranian-muddywater-hacking-group\/"},"modified":"2022-02-25T02:44:06","modified_gmt":"2022-02-25T02:44:06","slug":"us-and-uk-warn-of-attacks-from-iranian-muddywater-hacking-group","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/25\/us-and-uk-warn-of-attacks-from-iranian-muddywater-hacking-group\/","title":{"rendered":"US and UK warn of attacks from Iranian ‘MuddyWater’ hacking group"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

The U.S. and U.K. governments have issued<\/a> a joint cybersecurity advisory warning that an Iranian advanced persistent threat group is\u00a0conducting cyber espionage and other malicious cyber operations.<\/p>\n

The group, known as \u201cMuddyWater\u201d and part of Iran\u2019s Ministry of Intelligence and Security, has been targeting a range of government and private sector organizations in Asia, Africa, Europe and North America. Organizations targeted include telecommunications, defense, local government and oil and natural gas.<\/p>\n

MuddyWater is also known as\u00a0Earth Vetala, MERCURY, Static Kitten, Seedworm and TEMP.Zagros. The APT group dates back to 2018 and undertakes broad cyber campaigns supporting Iranian government objectives.<\/p>\n

The group exploits publicly reported vulnerabilities and uses open-source tools and strategies to gain access to sensitive data on targeted systems and deeply ransomware.<\/p>\n

Having exploited vulnerabilities, MuddyWater primarily deploys new variants of\u00a0PowGoop malware<\/a> as their main loader in malicious operations. PowGoop consists of a DLL loader and a PowerShell-based downloader and impersonates a legitimate file that is signed as a Google Update executable file.<\/p>\n

The joint advisory was issued by the U.S. Federal Bureau of Investigation, the Department of Homeland Security\u2019s Cybersecurity and Infrastructure Agency, the U.S. Cyber Command Cyber National Mission Force and the U.K. National Cyber Security Center.<\/p>\n

\u201cIranian government-sponsored actors are consistently targeting government and commercial networks through multiple means, including exploiting known vulnerabilities and spearphishing,\u201d a CISA spokesperson said. \u201cWe are committed to identifying nation-state threats to our critical infrastructure and helping organizations reduce their cyber risk.\u201d<\/p>\n

Iranian state-sponsored hacking campaigns were last in the news in January<\/a> when another group, known as APT 35, Phosphorous and Charming Kitten, was found to be actively exploiting vulnerabilities in Apache Log4j.<\/p>\n

\u201cWhile MuddyWater has been around for a while, the new tactics, techniques and procedures uncovered in this CISA Alert are interesting and in line with other actors we\u2019ve seen from Iran,\u201d\u00a0Drew Schmitt, principal threat intelligence analyst at cybersecurity consulting company GuidePoint Security LLC<\/a>, told SiliconANGLE. \u201cThe severity of this isn\u2019t probably that high, but timing is interesting with the Ukraine cyberattacks and conflict playing out in parallel.\u201d<\/p>\n

\u201cThis could be Iran stepping up operations based on a distracted worldview or some other reason,\u201d Schmitt added. \u201cIt really is hard to speculate on the rationale. Interestingly, the CISA alert does not seem to say whether this is a trend seen over a period of time or something quite new.\u201d<\/p>\n

Photo: Get Archive<\/a><\/h5>\n
\n
\n

Show your support for our mission by joining our Cube Club and Cube Event Community of experts. Join the community that includes Amazon Web Services and Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger and many more luminaries and experts.<\/span><\/h3>\n<\/div><\/div>\n