MuddyWater

Names and who uses them

• MuddyWaterOur name
• TEMP.ZagrosMandiant
• Mango SandstormMicrosoft
• MERCURYMITRE ATT&CK
• MuddyKrillMITRE ATT&CK
• Static KittenMITRE ATT&CK
• TA450Proofpoint
• SeedwormSymantec
• Earth VetalaTrend Micro

Targets

Sectors: Government, Defence, Finance, Telecommunications

Regions: Europe, Middle East, North America, Africa, Saudi Arabia

Known techniques

• T1003.001LSASS Memory
• T1003.004LSA Secrets
• T1003.005Cached Domain Credentials
• T1016System Network Configuration Discovery
• T1027.003Steganography
• T1027.004Compile After Delivery
• T1027.010Command Obfuscation
• T1033System Owner/User Discovery
• T1036.005Match Legitimate Resource Name or Location
• T1041Exfiltration Over C2 Channel
• T1047Windows Management Instrumentation
• T1049System Network Connections Discovery
• T1053.005Scheduled Task
• T1057Process Discovery
• T1059.001PowerShell
• T1059.003Windows Command Shell
• T1059.005Visual Basic
• T1059.006Python
• T1059.007JavaScript
• T1071.001Web Protocols
• T1074.001Local Data Staging
• T1082System Information Discovery
• T1083File and Directory Discovery
• T1087.002Domain Account
• T1090Proxy
• T1090.002External Proxy
• T1102.002Bidirectional Communication
• T1104Multi-Stage Channels
• T1105Ingress Tool Transfer
• T1113Screen Capture
• T1132.001Standard Encoding
• T1137.001Office Template Macros
• T1140Deobfuscate/Decode Files or Information
• T1190Exploit Public-Facing Application
• T1203Exploitation for Client Execution
• T1204.001Malicious Link
• T1204.002Malicious File
• T1204.004Malicious Copy and Paste
• T1210Exploitation of Remote Services
• T1218.003CMSTP

Malware and tools used