This report provides an analysis of MuddyWater, an Advanced Persistent Threat (APT) group, focusing on indicators observed in campaigns, discovered malware samples, tools, and their targeted industries. The findings are based on data sourced from open intelligence and cybersecurity research. It is not an in-depth analysis of MuddyWater tactics and tools but a collection of indicators to help identify similar activity, focusing on recent operations.
MuddyWater is an Iranian Advanced Persistent Threat (APT) group that has been active since 2017, specializing in cyberattacks with an emphasis on espionage. The group's operations primarily focus on the Middle East, targeting countries such as Israel, Saudi Arabia, Turkey, and the UAE. However, its attacks have also extended beyond the region, affecting countries such as India, the United States, Egypt, Sudan, Tanzania, Portugal, and Azerbaijan.
MuddyWater targets government institutions, telecommunications companies, the energy sector, military organizations, and manufacturing industries. These activities indicate a motivation centered on intelligence gathering, likely in the interests of Iranian state structures.
Iran
Espionage
Hacktivism
2017
SHA-256: 14c270cf53a50867e42120250abca863675d37abf39d60689e58288a9e870144
Sample: ANY.RUN
The command configures the AteraAgent service to automatically restart upon failure. It defines a 25-second delay before restarting and resets the failure counter if no failures occur within 10 minutes.
"C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
With the following TI lookup query, we can search through public tasks and identify this malicious activity.
TI lookup:
commandLine:"*sc.exe? failure AteraAgent reset= 600 actions= restart/25000"
39da7cc7c627ea4c46f75bcec79e5669236e6b43657dcad099e1b9214527670ec23f17b92b13464a570f737a86c0960d5106868aaa5eac2f2bac573c3314eb0f7e6b04e17ae273700cef4dc08349af949dbd4d3418159d607529ae31285e18f7e2810cca5d4b74e0fe04591743e67da483a053a8b06f3ef4a41bdabee9c48cf790f94d98386c179a1b98a1f082b0c7487b22403d8d5eb3db6828725d14392ded20aaeac4dbea89b50d011e9becdf51afc1a1a1f254a5f494b80c108fd3c7f61a55af6a90ac8863f27b3fcaa416a0f1e4ff02fb42aa46a7274c6b76aa000aacc2f925d929602c9bae0a879bb54b08f5f387d908d4766506c880c5d29986320cf99b49d6640f5f0f1d68f649252a96052f1d2e0822feadd7ebe3ab6a3cadd759855d7eb6c36d261adeef1a59bde9eb965f5d8d7f56a2e607da913e782167ba6cb614c270cf53a50867e42120250abca863675d37abf39d60689e58288a9e870144638c7a4f833dc95dbab5f0a81ef03b7d83704e30b5cdc630702475cc9fff86a2dd2675e2f6835f8a8a0e65e9dbc763ca9229b55af7d212da38b949051ae296a5165a80f6856487b3b4f41225ac60eed99c3d603f5a35febab8235757a273d1fdd22fd0cdd6ace24e117d7330e9996a2809c2c2cb280b12f9ea43c484d2bfcfd4f9c1a117de8519060a3bf189e72277e895345b8fece73fc0d750946c7f2883672722e289767ae391e3c3773b8640a8b9f6eb24c6a9d6e541f29c8765f7a8944bffbe988fd797cbb9a1eedb705cf00ebc8277cdbd9a21b6efb40a8bc22c7a43f02ae6c5c2b71361f71ded4ad90bbf6ef0b0f4778caf54078c928e2017302fbe69c6128f222f844e699760e32695d405bd5931635ec38ae50eddc17a0976ccefb4ff2ae62ba88e7068fa142bbe67d7b9398e8ae737a43cf36ace1fcf809776c909c2f95299d8aa912e1b753f3f0780a00ea6e8b5dab0245d77fcf3b6499677c328e89f48a7351c01cbf2f8e31c65a67f76a5ead689bb11e9d4918090a165d4425f326dd85d76d33f3f04cbe7eef6d10ea73f800c84bfc3ed6f3963403c981bbb6eec553e14b84ccca9b84e96a9ed19188a1ba5f4bf1ca278ab88f928f0b00b9bd009e09503962a2a8022859e72b86ad8c69dcbf79839b71897c0bf8a4c4b9f4dd6fb58c54a6d0ed24e85b213f0c487f8df05e421d7b07bd2bece3a925a855be93aSHA-256:a2ae5e994c0b515cadd425cfda4d4ae33b71893c45b702e1f8c1a495dc1b440f
Sample: ANY.RUN
SHA-256:3f9db7bf1c9d897d46f669854e7ecc945778024f04cac9cd1585140d0d73a34f
Sample: ANY.RUN
SHA-256:73c677dd3b264e7eb80e26e78ac9df1dba30915b5ce3b1bc1c83db52b9c6b30e
Sample: ANY.RUN
SHA-256:960d4c9e79e751be6cad470e4f8e1d3a2b11f76f47597df8619ae41c96ba5809
Sample: ANY.RUN
SHA-256:b8703744744555ad841f922995cef5dbca11da22565195d05529f5f9095fbfca
Sample: ANY.RUN
SHA-256:5df724c220aed7b4878a2a557502a5cefee736406e25ca48ca11a70608f3a1c0
Sample: ANY.RUN
Bugsleep creates a mutex PackageManager or DocumentUpdater.
With the following TI lookup query, we can search through public tasks and identify this malicious activity.
TI lookup:
(syncObjectName:"PackageManager" or syncObjectName:"DocumentUpdater") and syncObjectOperation:"Create"
9b49d6640f5f0f1d68f649252a96052f1d2e0822feadd7ebe3ab6a3cadd759855d7eb6c36d261adeef1a59bde9eb965f5d8d7f56a2e607da913e782167ba6cb614c270cf53a50867e42120250abca863675d37abf39d60689e58288a9e870144638c7a4f833dc95dbab5f0a81ef03b7d83704e30b5cdc630702475cc9fff86a2dd2675e2f6835f8a8a0e65e9dbc763ca9229b55af7d212da38b949051ae296a5165a80f6856487b3b4f41225ac60eed99c3d603f5a35febab8235757a273d1fdd22fd0cdd6ace24e117d7330e9996a2809c2c2cb280b12f9ea43c484d2bfcfd4f9c1a117de8519060a3bf189e72277e895345b8fece73fc0d750946c7f2883672722e289767ae391e3c3773b8640a8b9f6eb24c6a9d6e541f29c8765f7a8944bffbe988fd797cbb9a1eedb705cf00ebc8277cdbd9a21b6efb40a8bc22c7a43f02ae6c5c2b71361f71ded4ad90bbf6ef0b0f4778caf54078c928e2017302fbe69c6128f222f844e699760e32695d405bd5931635ec38ae50eddc17a0976ccefb4c2f95299d8aa912e1b753f3f0780a00ea6e8b5dab0245d77fcf3b6499677c328e89f48a7351c01cbf2f8e31c65a67f76a5ead689bb11e9d4918090a165d4425f326dd85d76d33f3f04cbe7eef6d10ea73f800c84bfc3ed6f3963403c981bbb6eec553e14b84ccca9b84e96a9ed19188a1ba5f4bf1ca278ab88f928f0b00b9bd009e09503962a2a8022859e72b86ad8c69dcbf79839b71897c0bf8a4c4b9f4dd64b41b605ffc0e31bd9d460d5a296ac6e8cfd56a215dc131e90ec2654f0ffe31b85103955e35a1355ce68a92eaedd8f9376de1927d95bf12657b348dea6a8077bbab601635aafeae5fbfe1c1f7204de17b189b345efd91c46001f6d83efbb3c5a900d08037d303d9b3d4a855e1a97d1f9283c28fe279e67eefe9997f856eeb439cc8be1d525853403f6cfabcf0fc3bd0ca398ece559388102a7fc55e9f3aa9b337daab239271e088f04cae95627cc0066f48a1b178a1ff60b1140aa729126e928cc4cc20b558096855c5d492f7a79b160a809355798be2b824525c98964450492f17f6866f4748e6e762752062acdf983d3b083371db83503686b91512b9bcae37e6a5e32596b99f45ea9099a14507a82c10a460c56585499d7cd640f2625567ffb02e97d52a00fca1580ca71ed152dd28dd5ae28ab0a9c8e7b32cebd7f1998a1hxxps[:]v2uploads.zopim.io/2/u/K/2uKM8Mhn4WHvqm9pjHrjaogyOYub9ouO/892fedae59b274ca24916de33650d318168ce335.ziphxxps[:]v2uploads.zopim.io/2/u/K/2uKM8Mhn4WHvqm9pjHrjaogyOYub9ouO/064eab6bff1b47eb92cbf1ed35f57098e5e686b2.msihxxps[:]ln5.sync.com/dl/cc84c9a40/grefpuhc-p9kmxpkx-kw6waakz-e8xp8atmhxxps[:]megolan.egnyte.com/hxxps[:]kinneretacil.egnyte.com/hxxps[:]rimonnet.egnyte.com/eb0bba584138044e2d051deab69a57f1809334c0b55009c5a50f37e4eec63c434055d8b5c2e909f5db8b75a5750a7005cdeb7abfc7775c63745135431272dda3c381c2cb8fdd6acf1636280b9424f573473dfccda44f85d119aadefb92cd085e24c72ffef74be81c5a7d4cb0241103281e9a4e774b61acc8a6b35ee50417e661ef6ec560efd05d21976a6fd3f489e206a2571577f281eda9548d9047b37cbbb8b181ecbb7394e3b1394a8c97af65b7e25d61614099d6d567441d15c58d6517b05d013b96a25f0610cd1ac45d61d44d7eaba760ec55fdeccb35adb068443feb896bc591f4e8eb1ea54b4d6defd019bee823d99f912f2491749b89e4fd337273bc242098c3e87822bffa7c337987065fbe387fd14f5a89ec121c4c2c989063822f83044ce990501559e34f5a64318778a893be13bbcad30440a0d0ef3868d67003f1c935ce028022ab2a495eae83adacc6fa55d4fe55eb4b9b34804d94bcd2f88f7ce27d43bdbb6c9238c5d367a86dc37bfa6d5164772ba72dc3931dae8e09b48871ffc9ebbb80f4e2f405034662dfd4243c1b429685e5f1853a3cd955bd0acbd764fc017a451ef273dcacdf6c099031f3c67d578a14571e4f56430ce4bdc228f9e8f3ecc0456fcbbb029b1c27dc1faad0dd247ccd7cc3a13e1c72bb01cf3a816d8d2199fa11c6a8d95c1c2b4add70373a04afff1465a223a806774104b652a4f0146cc3a1a68be349e70b79f9115c496b2cd569dafe4f537150f0416b021c30abe8e84ac1ae83a45c260df146e97cb1cba8fce1e8e89053e143b5431cfa5209cb960594cbdf938bcb03bd0637843d9154b9cff91be734e2a071d3b0fc07dc8386d16bb327c655ac5e52c9452cedb369daad4ce3a58db27f40e17abf633e319efed1b4ca2933f49494b4400d5bf5ab502e244a4f81cff4a8dc5872628a40713735aaa9db79b5d6ba319e24e6180a7935d67ed44b36850a5f192fb56768669d809066fddebf896a5631172436b740c06ad18e5ba70473c66334ced67ac3be9970e08b50f74907810cf23507b5bd8d83f13cc4a88707bba871a667004a4a27de6785a85460ff7d12ccc2b82da8143ac1f594c5a737a346e0a83082b924712926af7d7aeb1fe9ab3efffcf390eadaff6964111f0b9aed4b2c8d958a9b396852a62c9dde578308ac3403ae9e88616b8a292383hxxps[:]//ws.onehub.com/files/x68hqy91hxxps[:]//ws.onehub.com/files/97lrcyvchxxps[:]//ws.onehub.com/files/gts7uevhhxxps[:]//ws.onehub.com/files/v5ww52nehxxps[:]//ws.onehub.com/files/kwdphknmhxxps[:]//freeupload.store/rALE7/wIHItUcE08.msi/downloadhxxps[:]//kinneretacil.egnyte.com/fl/gRykrFURtEhxxps[:]//filetransfer.io/data-package/tuMe19fV/downloadhxxps[:]//ws.onehub.com/files/mz8ok6gfhxxp[:]//a.storyblok.com/f/259791/x/91e2f5fa2f/attachments.ziphxxps[:]//a.storyblok.com/f/259837/x/21e6a04837/defense-video.ziphxxps[:]//ws.onehub.com/files/94otjyvdhxxps[:]//ws.onehub.com/files/7w1372elhxxps[:]//1drv.ms/u/s!Ah4-vpXOyPCGdd1DkLHmbL2qXQU?e=RkaudWhxxps[:]//www.dropbox.com/s/scj6n0l58yyb3f1/Purchase%20Order%20for%20Supplies--no12305570.zip?dl=0hxxps[:]//a.storyblok.com/f/259791/x/94f59e378f/questionnaire.zipinstance-sy9at2-relay.screenconnect[.]cominstance-uwct38-relay.screenconnect[.]com51.255.19[.]178:44351.254.25[.]36:443178.32.30[.]3:443146.70.149[.]61:8008193.109.120[.]59:8008DarkBeatC2 Deep Instinct Report
185.236.234[.]161185.216.13[.]24245.66.249[.]226164.132.237[.]6895.164.61[.]6495.164.46[.]5491.225.218[.]21095.164.38[.]6845.140.147[.]8180.71.157[.]130103.35.190[.]203353b4643ec51ecff7206175d930b07133dd1f91f89dc70e90f7bc001ed50c9e7bede9522ff7d2bf7daff04392659b8a832bfe46efceae5813b75b40852fde3c2b7d15723d7ef47497c6efb270065ed84Proofpoint researchers recently observed new activity by TA450
dee6494e69c6e7289cf3f332e2867662958fa82f819615597e88c16c967a25a9hxxps[:]//ws.onehub.com/files/hxxps[:]//salary.egnyte.com/hxxps[:]//ln5.sync.com/hxxps[:]//terabox.com/s/Iranian Hackers Target Telecoms Orgs in North and East Africa
1a0827082d4b517b643c86ee678eaa53f85f1b33ad409a23c50164c3909fdaca25b985ce5d7bf15015553e30927691e7673a68ad071693bf6d0284b069ca6d6aeac8e7989c676b9a894ef366357f1cf8e285abde083fbdf92b3619f707ce292f3916ba913e4d9a46cfce437b18735bbb5cc119cc97970946a1ac4eab6ab3923094.131.109[.]6595.164.38[.]9945.67.230[.]9145.150.64[.]3995.164.46[.]19994.131.98[.]1494.131.3[.]160MuddyC2Go Deep Instinct Report
34212eb9e2af84eceb6a8234d28751b63c6486dfb691fc6642f1d35bdf247b9055b99af81610eb65aabea796130a0462d7ca8f3b5e21ed56abf32ac7cb158a7ed3a2dee3bb8fcd8e8a0d404e7d1e6efb4a70b1e4cb57c99502d89cdbbbed48343f08aa714fd59b68924843cbfddac4b15db0e68d7d81f5c21e6e458445fd6e34bdbcc0e9c1c6c1fff790caa0b2ffc2fe5e07adc4ee768126dc7c7339f4cb00120feede05ba166a3c8668fe580a3399d8f9894b84916f9264d897fe3b4a83bc6089957250940377b39e405114f0a2fe84b245c3ed373727c21ad9ee862b767e36222971759adf816c6fb43104c0e1d89d65e0cc23a6406930a40696594021edb5f79a638b2f2cc82bfe137f1d12534cda5fc523904ca6e191eb2fdb254a6225577b867ec1cef6b1618a21853fb8cafd6e157641ce5af4482038c9ea27afcc087eefe5f94e5df19d95df26aaf774daad9df45.150.64[.]23995.164.46[.]35New TTPs of Muddy Water Deep Instinct Report
37c3f5b3c814e2c014abc1210e8e69a216923d827a440161217fb66a04e8b40a7568062ad4b22963f3930205d1a14df739eea24572c14910b67242a16e24b7682e09e53135376258a03b7d793706b70f065f0871b6025b8e61f35a188bca1d5c6167f03c8b2734c20eb02d406d3ba651952cc4e278051e349e870aa80babc755hxxps[:]//ws.onehub.com/files/7f9dxtt6hxxps[:]//a.storyblok.com/f/253959/x/b92ea48421/form.ziphxxps[:]//a.storyblok.com/f/255988/x/5e0186f61d/questionnaire.ziphxxps[:]//a.storyblok.com/f/259791/x/94f59e378f/questionnaire.zip146.70.149[.]61146.70.124[.]10237.120.237[.]20437.120.237[.]24845.159.248[.]24491.121.240[.]104195.20.17[.]4445.86.230[.]20137.74.131[.]30178.32.30[.]3137.74.131[.]2446.249.35[.]243185.254.37[.]173194.61.121[.]8687.236.212[.]2291.235.234[.]130157.90.153[.]60157.90.152[.]2665.21.183[.]23845.132.75[.]10151.255.19[.]178103.73.65[.]129103.73.65[.]225103.73.65[.]244103.73.65[.]246103.73.65[.]253137.74.131[.]16137.74.131[.]18137.74.131[.]25164.132.237[.]67164.132.237[.]797cb0cc6800772e240a12d1b87f9b7561412f44f01f6bb38829e84acbc8353b9c5ca26988b37e8998e803a95e4e7e3102fed16e99353d040a5b22aa7e07438fea1c95496da95ccb39d73dbbdf9088b57347f2c91cf79271ed4fe1e5da3e0e542a2f14ce9e4e8b1808393ad090289b5fa287269a878bbb406b6930a6c575d1f736b4b3c3ee293046e2f670026a253dc39e863037b9474774ead6757fe27b0b63c1b38d036bbe2d902724db04123c87aeea663c8ac4c877145ce8610618d8e6571f77cb08c7889c7b0d443aeacfdcbc1cc6745d3e3441f4b42ddbf7fde6113491aehxxps[:]//ws.onehub[.]com/files/4mbha9wdhxxps[:]//kinneretacil.egnyte[.]com/fl/wERX5mfnFx137.74.131[.]19149.202.242[.]80141.95.177[.]133141.95.177[.]129137.74.131[.]20149.202.242[.]86141.95.177[.]132141.95.177[.]142137.74.131[.]22164.132.237[.]64164.132.237[.]78137.74.131[.]24164.132.237[.]66141.95.177[.]134178.32.30[.]3137.74.131[.]3051.255.19[.]18391.121.240[.]10551.254.25[.]36141.95.177[.]130141.95.177[.]13191.121.240[.]10091.121.240[.]110137.74.131[.]16137.74.131[.]18149.202.242[.]87149.202.242[.]85151.80.172[.]146149.202.242[.]84151.80.172[.]14737.187.204[.]26151.80.172[.]149164.132.237[.]65164.132.237[.]70164.132.237[.]71164.132.237[.]74164.132.237[.]75164.132.237[.]76178.32.30[.]0178.32.30[.]1178.32.30[.]237.187.204[.]255.196.249[.]1615.196.249[.]16251.83.56[.]22691.121.240[.]10291.121.240[.]10391.121.240[.]10691.121.240[.]10791.121.240[.]10891.121.240[.]10991.121.240[.]11191.121.240[.]9691.121.240[.]9891.121.240[.]9991.134.169[.]13791.134.169[.]139Sekoia.io GitHub repository, RotRot backdoor
rule apt_MuddyWater_MuddyRot_strings {
meta:
id = "f7bc195a-0e60-4495-b78a-78f101543700"
version = "1.0"
malware = "MuddyRot"
intrusion_set = "MuddyWater"
description = "Detects RotRot backdoor based on strings permutations"
source = "Sekoia.io"
creation_date = "2024-06-10"
classification = "TLP:WHITE"
strings:
$s1 = "qsphsbnebub"
$s2 = "rtqitcofcvc"
$s3 = "surjudpgdwd"
$s4 = "tvskveqhexe"
$s5 = "uwtlwfrifyf"
$s6 = "vxumxgsjgzg"
$t1 = "MpbeMjcsbs"
$t2 = "NqcfNkdtct"
$t3 = "OrdgOleudu"
$t4 = "PsehPmfvev"
$t5 = "QtfiQngwfw"
$t6 = "RugjRohxgx"
$u1 = "UfsnjobufKpcPckfdu"
$u2 = "VgtokpcvgLqdQdlgev"
$u3 = "WhuplqdwhMreRemhfw"
$u4 = "XivqmrexiNsfSfnigx"
$u5 = "YjwrnsfyjOtgTgojhy"
$u6 = "ZkxsotgzkPuhUhpkiz"
condition:
uint16be(0) == 0x4d5a and
filesize > 100KB and filesize < 300KB and
any of ($s*) and any of ($t*) and any of ($u*)
}
Sekoia.io GitHub repository, malicious PDF
rule apt_MuddyWater_malicious_pdf {
meta:
id = "77983aea-47cb-4436-b773-faf7be430339"
version = "1.0"
intrusion_set = "MuddyWater"
description = "Detects malicious PDF used by MuddyWater"
source = "Sekoia.io"
creation_date = "2024-06-10"
classification = "TLP:WHITE"
strings:
$ = "egnyte.com/fl/"
$ = "/Type/Pages/Count 1"
condition:
uint32be(0) == 0x25504446 and
filesize < 300KB and
all of them
}
Inside The Lab Report, Detect Atera Agent(1)
rule MuddyWater_AteraAgent_Operators
{
meta:
description = "Detect Atera Agent abused by MuddyWater"
references = "TRR240402"
hash = "9b49d6640f5f0f1d68f649252a96052f1d2e0822feadd7ebe3ab6a3cadd75985"
date = "2024-04-17"
author = "HarfangLab"
context = "file"
strings:
$s1 = "COMPANYID001Q3000009snPyIAIACCOUNTID"
$s2 = "COMPANYID001Q3000006FpmoIACACCOUNTID"
$s3 = "COMPANYID001Q3000008IyacIACACCOUNTID"
$s4 = "COMPANYID001Q3000009QoSEIA0ACCOUNTID"
$s5 = "COMPANYID001Q30000023c7iIAAACCOUNTID"
$s6 = "COMPANYID001Q3000008qXbDIAUACCOUNTID"
$s7 = "COMPANYID001Q3000008cfLjIAIACCOUNTID"
$s8 = "COMPANYID001Q3000007hJubIAEACCOUNTID"
$s9 = "COMPANYID001Q3000008ryO3IAIACCOUNTID"
$s10 = "COMPANYID001Q300000A5nnAIARACCOUNTID"
$s11 = "COMPANYID001Q3000008JfioIACACCOUNTID"
$s12 = "COMPANYID001Q300000BeUp3IAFACCOUNTID"
$s13 = "COMPANYID001Q3000005gMamIAEACCOUNTID"
$s15 = "mrrobertcornish@gmail.comINTEGRATORLOGINCOMPANYID"
$cert1 = { 0A 28 49 99 78 E5 89 8D F4 0A 23 8E B8 A5 52 E8 } // Atera Network certificate 2024-02-15 - 2025-03-18
$cert2 = { 06 7F 60 47 95 66 24 A7 15 99 61 74 3D 81 94 93 } // Atera Network certificate 2022-02-17 - 2024-03-16
condition:
filesize > 1MB and filesize < 4MB
and (uint16be(0) == 0xD0CF)
and any of ($s*)
and any of ($cert*)
}
Inside The Lab Report, Detect Atera Agent(2)
rule Custom_AteraAgent_Operator
{
meta:
description = "Detect Atera Agent configured to certain email addresses, or email domains"
references = "TRR240402"
date = "2024-04-17"
author = "HarfangLab"
context = "file"
strings:
$email = "email@domain.tld" // Change email address
$s1 = "PREVIOUSFOUNDWIX_UPGRADE_DETECTED"
$s2 = "INTEGRATORLOGIN"
$sc1 = { 0A 28 49 99 78 E5 89 8D F4 0A 23 8E B8 A5 52 E8 } // Atera Network certificate 2024-02-15 - 2025-03-18
$sc2 = { 06 7F 60 47 95 66 24 A7 15 99 61 74 3D 81 94 93 } // Atera Network certificate 2022-02-17 - 2024-03-16
condition:
filesize > 1MB and filesize < 4MB
and (uint16be(0) == 0xD0CF)
and @s1 < @email
and @email < @s2[3]
and any of ($sc*)
}