State-Backed Iranian APT Attacks Targets in Turkey
According to security intelligence researchers with Cisco Talos, an advanced persistent threat group operating out of Iran has been targeting both private and government organizations located in Turkey.
The APT in question is known under a number of aliases, including MuddyWater, Mercury, and Static Kitten and is believed to have ties to the Iranian Ministry of Intelligence and Security. The threat actor has been on the radar of security researchers for around four years now and has pulled off past attacks targeting entities in the US, Europe, and Middle Eastern countries.
MuddyWater APT Linked to Iranian State
The United States Cyber Command, a unit of the US Department of Defense, recently linked the threat actor to the Iranian authorities, saying the group conducts "intelligence activities" for the Middle Eastern country's government.
According to researchers, the last campaign run by MuddyWater was launched in the last couple of months of 2021 and used malware-laced PDF files as its early vector of attack. The campaign used phishing mail with the malware-laden PDFs attached. The emails were spoofing official Turkish government organizations and addresses, including the Turkish ministries of health and interior affairs.
The malicious PDFs contained embedded Visual Basic macros engineered to run PowerShell scripts on the victim system. The PowerShell commands would run a downloader that gives the hackers code execution powers and allows them to achieve persistence through registry value edits.
Cyberespionage and Data Exfiltration
Once the Iranian APT would gain a foothold on a victim system, it would collect data related to valuable intellectual property and conduct cyberespionage. Additionally, the APT would install and execute ransomware on the victim systems, but more in an effort to wipe the victim networks and erase tracks than to collect a ransom.
The MuddyWater APT has also been using canary tokens to track when a file has been accessed. This prevented Talos from securing the final payload used in those latest attacks, as the C2 server ran verification checks that disrupted those attempts.
