TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Bleeping Computer

MuddyWater hackers use Chaos ransomware as a decoy in attacks

Bill Toulas · 10 hours ago · Read original ↗

ATT&CK techniques detected

8 predictions
T1078Valid Accounts
86%
“that the state - sponsored group used to sign stagecomp and darkcomp malware attributed to the threat actor, and various operational tradecraft. muddywater is an iranian state - sponsored cyber - espionage group, notorious for long - term network intrusion campaigns that align wi…”
T1219Remote Access Tools
78%
“a domain controller, and established persistence using rdp, dwagent, and anydesk. next, they leveraged a malware loader ( ms _ upd. exe ) to drop a custom backdoor ( game. exe ), disguised as a microsoft webview2 application. the malware features anti - analysis and anti - vm che…”
T1486Data Encrypted for Impact
77%
“a domain controller, and established persistence using rdp, dwagent, and anydesk. next, they leveraged a malware loader ( ms _ upd. exe ) to drop a custom backdoor ( game. exe ), disguised as a microsoft webview2 application. the malware features anti - analysis and anti - vm che…”
T1486Data Encrypted for Impact
76%
“muddywater hackers use chaos ransomware as a decoy in attacks the muddywater iranian hackers disguised their operations as a chaos ransomware attack, relying on microsoft teams social engineering to gain access and establish persistence. although the attack involved credential th…”
T1588.001Malware
64%
“muddywater hackers use chaos ransomware as a decoy in attacks the muddywater iranian hackers disguised their operations as a chaos ransomware attack, relying on microsoft teams social engineering to gain access and establish persistence. although the attack involved credential th…”
T1080Taint Shared Content
57%
“a domain controller, and established persistence using rdp, dwagent, and anydesk. next, they leveraged a malware loader ( ms _ upd. exe ) to drop a custom backdoor ( game. exe ), disguised as a microsoft webview2 application. the malware features anti - analysis and anti - vm che…”
T1657Financial Theft
49%
“muddywater hackers use chaos ransomware as a decoy in attacks the muddywater iranian hackers disguised their operations as a chaos ransomware attack, relying on microsoft teams social engineering to gain access and establish persistence. although the attack involved credential th…”
T1566.004Spearphishing Voice
39%
“that the state - sponsored group used to sign stagecomp and darkcomp malware attributed to the threat actor, and various operational tradecraft. muddywater is an iranian state - sponsored cyber - espionage group, notorious for long - term network intrusion campaigns that align wi…”

Summary

The MuddyWater Iranian hackers disguised their operations as a Chaos ransomware attack, relying on  Microsoft Teams social engineering to gain access and establish persistence. [...]