Middle East-linked hacking group is working hard to mask its moves

The group bears a resemblance to MuddyWater.

A group that’s been linked to Iranian-based hackers has been working to obfuscate its activities to evade detection, according to new research from Cisco’s Talos researchers.

The hackers, whose attacks are ongoing, are working to avoid host-based signatures and Yara signatures by using a Visual Basic for Applications (VBA) script, PowerShell stager attacks, and a separate command and control server, researchers write in a blog post. In some cases the group, which Talos has dubbed “BlackWater,” has been successful in avoiding detection mechanisms.

Some of the code the group has used in its attacks is the same as that used by a group known as MuddyWater. Talos writes the code was used in attacks against Kurds in Turkey.

This code overlap and the fact that BlackWater and MuddyWater have had similar targets, including those in Turkey, lead Talos researchers to report they have “moderate confidence” that the actors behind BlackWater and Iranian-linked MuddyWater are related.

Jonathan Wrolstad, principal cyber intelligence analyst at Symantec, said he believes this activity is related to MuddyWater, as well.

“Within this set of activity, Symantec identified PowerShell commands and malware tools, such as a tool for stealing browser credentials, that have been used in the past by the MuddyWater group,” Wrolstad told CyberScoop.

Ben Read, a senior manager of cyber-espionage analysis at FireEye, tells CyberScoop that the company is not at the point of directly linking these two groups yet.

“We haven’t linked it to the broader MuddyWater stuff because it does look a little bit different,” Read said. “There’s some overlaps, but not enough for us to say they’re definitely the same group.”

In addition to tracking some of this new activity, FireEye has seen MuddyWater expand its targets, Read tells CyberScoop. While the group, which FireEye calls Zagros, has traditionally targeted Asian countries, the group expanded their targets to oil companies based in Latin America.

“We continue to see traditional MuddyWater and traditional Zagros [activity] ongoing recently as well,” he said. “There’s been a bit of a broadening.”

Based on a sample obtained in April, some of the obfuscating tactics that Talos found include trying to obtain remote access to victims’ machines by installing PowerShell backdoors, a technique that exploits existing management tools on computers. The group is also using an obfuscated Visual Basic for Applications (VBA) script to establish persistence as a registry key.

The PowerShell stager then communicates with an actor-controlled server to use part of a post-exploitation open source framework on GitHub, known as FruityC2, to gain visibility into how their attack is propagating throughout the victims’ machines.

Talos researchers assess that based on how the VBA functions, the group is likely trying to make the backdoors look like red-teaming attempts.

Talos researchers assess that the way the group has been using the FruityC2 script could allow the attackers to see whether someone is investigating their activity. In the past, MuddyWater has threatened security researchers’ lives when they came across the threat group’s command and control server, according to research from TrendMicro.

MuddyWater has worked to conceal its identity before — for instance, the group has used lines of code, “false flags,” borrowed from tools that are typically linked with another country, such as China, for example, and has attempted to imitate Kaspersky Lab in some of its correspondence.

Wrolstad told CyberScoop the methods Talos identifies in its blog post may not be an increase in MuddyWater’s efforts to disguise, but par for the course.

“They work hard to develop new malware tools and evade detection and continue to evolve their operations quickly,” Wrolstad said. “It’s therefore hard to quantify, as obfuscation and change in techniques is standard practice for the group. Their efforts to evolve and evade detection started fast and remain fast.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure