ETDA ThaiCERT
Report
Search
Home > List all groups > MuddyWater, Seedworm, TEMP.Zagros, Static Kitten

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link APT group: MuddyWater, Seedworm, TEMP.Zagros, Static Kitten

NamesMuddyWater (Palo Alto)
Seedworm (Symantec)
TEMP.Zagros (FireEye)
Static Kitten (CrowdStrike)
Mercury (Microsoft)
TA450 (Proofpoint)
ATK 51 (Thales)
T-APT-14 (Tencent)
ITG17 (IBM)
CountryIran Iran
SponsorState-sponsored, IRGC (Islamic Republic Guard Corps)
MotivationInformation theft and espionage
First seen2017
Description(Reaqta) MuddyWater is an APT group that has been active throughout 2017, targeting victims in Middle East with in-memory vectors leveraging on Powershell, in a family of attacks now identified as “Living off the land”, as they don’t require the creation of new binaries on the victim’s machine, thus maintaining a low detection profile and a low forensic footprint.

The operators behind MuddyWater are likely espionage motivated, we derive this information from the analysis of data and backdoors behaviors. We also find that despite the strong preponderance of victims from Pakistan, the most active targets appear to be in: Saudi Arabia, UAE and Iraq. Amongst the victims we identify a variety of entities with a stronger focus at Governments, Telcos and Oil companies.

By tracking the operations we finally figure out that the originating country is likely to be Iran, while it remains harder to ascertain whether MuddyWater is state sponsored or a criminal organization incline to espionage.
ObservedSectors: Defense, Education, Energy, Financial, Food and Agriculture, Gaming, Government, Healthcare, High-Tech, IT, Media, NGOs, Oil and gas, Telecommunications, Transportation.
Countries: Afghanistan, Armenia, Austria, Azerbaijan, Bahrain, Belarus, Egypt, Georgia, India, Iran, Iraq, Israel, Jordan, Lebanon, Mali, Netherlands, Oman, Pakistan, Russia, Saudi Arabia, Tajikistan, Tunisia, Turkey, UAE, Ukraine, USA.
Tools usedChromeCookiesView, chrome-passwords, CLOUDSTATS, CrackMapExec, DELPHSTATS, EmpireProject, FruityC2, Koadic, LaZagne, Meterpreter, Mimikatz, Mudwater, MZCookiesView, Powermud, PowerSploit, POWERSTATS, PowGoop, PRB-Backdoor, QUADAGENT, Secure Socket Funneling, SHARPSTATS, Shootback, Smbmap, Living off the Land.
Operations performedFeb 2017The MuddyWater attacks are primarily against Middle Eastern nations. However, we have also observed attacks against surrounding nations and beyond, including targets in India and the USA.
<https://unit42.paloaltonetworks.com/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/>
Jan 2018Updated Tactics, Techniques and Procedures in Spear Phishing Campaign
We attribute this activity to TEMP.Zagros (reported by Palo Alto Networks and Trend Micro as MuddyWater), an Iran-nexus actor that has been active since at least May 2017. This actor has engaged in prolific spear phishing of government and defense entities in Central and Southwest Asia.
<https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html>
Mar 2018Campaign Possibly Connected to “MuddyWater” Surfaces in the Middle East and Central Asia
We discovered a new campaign targeting organizations in Turkey, Pakistan and Tajikistan that has some similarities with an earlier campaign named MuddyWater, which hit various industries in several countries, primarily in the Middle East and Central Asia.
<https://blog.trendmicro.com/trendlabs-security-intelligence/campaign-possibly-connected-muddywater-surfaces-middle-east-central-asia/>
May 2018Another Potential MuddyWater Campaign uses Powershell-based PRB-Backdoor
In May 2018, we found a new sample (Detected as W2KM_DLOADR.UHAOEEN) that may be related to this campaign. Like the previous campaigns, these samples again involve a Microsoft Word document embedded with a malicious macro that is capable of executing PowerShell (PS) scripts leading to a backdoor payload. One notable difference in the analyzed samples is that they do not directly download the Visual Basic Script(VBS) and PowerShell component files, and instead encode all the scripts on the document itself. The scripts will then be decoded and dropped to execute the payload without needing to download the component files.
<https://blog.trendmicro.com/trendlabs-security-intelligence/another-potential-muddywater-campaign-uses-powershell-based-prb-backdoor/>
May 2018We recently noticed a large amount of spear phishing documents that appear to be targeting government bodies, military entities, telcos and educational institutions in Jordan, Turkey, Azerbaijan and Pakistan, in addition to the continuous targeting of Iraq and Saudi Arabia, other victims were also detected in Mali, Austria, Russia, Iran and Bahrain.. These new documents have appeared throughout 2018 and escalated from May onwards. The attacks are still ongoing.
<https://securelist.com/muddywater/88059/>
Sep 2018Group remains highly active with more than 130 victims in 30 organizations hit since September 2018.
Seedworm’s motivations are much like many cyber espionage groups that we observe—they seek to acquire actionable information about the targeted organizations and individuals. They accomplish this with a preference for speed and agility over operational security, which ultimately led to our identification of their key operational infrastructure.
<https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group>
Nov 2018Operations in Lebanon and Oman
MuddyWater has recently been targeting victims likely from Lebanon and Oman, while leveraging compromised domains, one of which is owned by an Israeli web developer. The investigation aimed to uncover additional details regarding the compromise vector. Further, we wished to determine the infection vector, which is currently unknown. With that in mind, past experience implies that this might be a two-stage spear-phishing campaign.
<https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf>
Apr 2019Targeting Kurdish Political Groups and Organizations in Turkey
However, unlike the previous vector, we did not identify this time any compromised servers used to host the malware’s code. Instead, the lure document already contains the malicious code. We also detected five additional files that operate in a similar file to the aforementioned document; but unlike that file, these do not have any content.
<https://www.clearskysec.com/muddywater-targets-kurdish-groups-turkish-orgs/>
Apr 2019The Iranian APT, MuddyWater, has been active since at least 2017. Most recently though, a new campaign, targeting Belarus, Turkey and Ukraine, has emerged that caught the attention of Check Point researchers.
<https://research.checkpoint.com/the-muddy-waters-of-apt-attacks/>
Apr 2019Operation “BlackWater”
Newly associated samples from April 2019 indicate attackers have added three distinct steps to their operations, allowing them to bypass certain security controls and suggesting that MuddyWater’s tactics, techniques and procedures (TTPs) have evolved to evade detection.
<https://blog.talosintelligence.com/2019/05/recent-muddywater-associated-blackwater.html>
Jun 2019Clearsky has detected new and advanced attack vector used by MuddyWater to target governmental entities and the telecommunication sector. Notably, the TTP includes decoy documents exploiting CVE-2017-0199 as the first stage of the attack. This is followed by the second stage of the attack – communication with the hacked C2 servers and downloading a file infected with the macros.
<https://www.clearskysec.com/muddywater2/>
Jun 2019We came across new campaignsthat seem to bear the markings of MuddyWater –a threat actor group with a history of targeting organizations in Middle Eastern and Asian countries. The group used new tools and payloads in campaigns over the first half of 2019, pointing to the continued work the group has put in since our last report on MuddyWaterin November 2018.
<https://documents.trendmicro.com/assets/white_papers/wp_new_muddywater_findings_uncovered.pdf>
Sep 2020Operation “Quicksand”
During September 2020, weidentified a new campaign targeting many prominent Israeli organizations.
<https://www.clearskysec.com/wp-content/uploads/2020/10/Operation-Quicksand.pdf>
Oct 2020MSTIC has observed activity by the nation-state actor MERCURY using the CVE-2020-1472 exploit (ZeroLogon) in active campaigns over the last 2 weeks.
<https://www.zdnet.com/article/microsoft-says-iranian-hackers-are-exploiting-the-zerologon-vulnerability/>
Counter operationsMay 2019New leaks of Iranian cyber-espionage operations hit Telegram and the Dark Web
<https://www.zdnet.com/article/new-leaks-of-iranian-cyber-espionage-operations-hit-telegram-and-the-dark-web/>
Update: this leak may have been the work of the CIA.
Information<https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/>
<https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group>
MITRE ATT&CK<https://attack.mitre.org/groups/G0069/>
Playbook<https://pan-unit42.github.io/playbook_viewer/?pb=muddywater>

Last change to this card: 19 October 2020

Download this actor card in PDF or JSON format

Previous: MoneyTaker
Next: Mustang Panda, Bronze President

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key