Excerpt
The Iranian APT, MuddyWater, has been active since at least 2017. Most recently though, a new campaign, targeting Belarus, Turkey and Ukraine, has emerged that caught the attention of Check Point researchers.
Ever since at least 2017, the attackers behind MuddyWater have used a simple yet effective infection vector: Spear-phishing. Attacks usually begin with a targeted email sent to an organization. The next step is to steal legitimate documents from the compromised systems within that organization and then weaponize and distribute them to other unsuspecting victims.
To do this, a lure message that prompts the user to enable their content is added to those files, which are often ca…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Check Point on research.checkpoint.com.
Mentioned in the excerpt
More from Check Point88
- Gozi: The Malware with a Thousand FacesCheck Point · Published 28 Aug 2020
- Shattering the Dream - When a Job Offer Becomes a Zero-Day AttackCheck Point · Published 11 Aug
- Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution EcosystemCheck Point · Published 3 Jun
- Cavern Manticore: Exposing Iran-Linked Modular C2 FrameworkCheck Point · Published 6 Jul
On the same topics
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Chinese Nation-State Hackers Target U.S in Operation TradeSecret, Report Claimseweek.com · Published 6 Apr 2017
- Taiwan High-Tech Ecosystem Targeted by Foreign APT Group:Medium · Published 10 Jun 2022
