Middle East group goes on hacking spree against telecoms, embassies and more

Researchers found the suspected Iranian group on the same embassy network as Fancy Bear.

A group likely operating out of the Middle East has compromised 131 victims in 30 organizations since September, including telecommunications firms, a Russian oil and gas company and unidentified government embassies, new research shows.

The hackers have hit organizations in Pakistan, Russia, Saudi Arabia, Turkey, and North America, among other places, in an espionage operation designed to acquire “actionable information” on targets, cybersecurity company Symantec said Monday. After breaching a system, the group runs a password-stealing program with the likely aim of accessing victims’ email and social media accounts, researchers found.

The group, dubbed Seedworm by Symantec and MuddyWater by others, gained notoriety earlier this year for threatening to kill security researchers investigating it. That followed a spearphishing campaign from January to March against government and defense organizations in Central and Southwest Asia, which cybersecurity company FireEye documented.

While there has been no definitive public attribution of MuddyWater, Ben Read, FireEye’s senior manager of analysis, told CyberScoop the group’s activity “aligns with Iran’s interest.” For their part, Symantec’s research team said the group is likely backed by a nation-state.

Most of the victims for which Symantec identified a sector were telecom and IT service providers that offer attackers a foothold into other organizations. All 11 of the victims in oil and gas are part of one Russian company with a presence in the Middle East, Symantec said. The group also targeted the embassies of Middle Eastern countries in Europe.

The cache of new data from Symantec offer insight into MuddyWater’s tactics, techniques, and procedures. That includes a new backdoor the group uses for remote access to victim networks, a GitHub repository for storing malicious scripts, and several hacking tools for exploiting targets after they are compromised.

The research sprung from an intriguing discovery that highlights how, in the field of cyber-espionage, state-sponsored actors show up on the same victim network. In September, Symantec found evidence that both MuddyWater and Fancy Bear, the infamous hacking group linked with Russian intelligence, were on the network of an “oil-producing” nation’s embassy in Brazil.

“It is not common, but it is not unusual either that an embassy would have two different compromises due to their frequent targeting,” Jonathan Wrolstad, principal cyber intelligence analyst at Symantec, told CyberScoop. Malware on the embassy’s network distinguished the two groups, he added.

Like other advanced groups, MuddyWater has a knack for using open-source tools alongside their own custom resources. “Choosing to rely on publicly available tools allows Seedworm to quickly update their operations by using code written by others and applying only small customizations,” the research says.

There is no sign of MuddyWater letting up. FireEye’s Read said the group, which his company calls TEMP.Zagros, “has continued to target multiple countries in the Middle East and Central Asia,” with a focus on foreign affairs ministries and other government targets.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure