A politically motivated hacker group tied to a series of espionage and sabotage attacks on Israeli entities in 2021 incorporated a previously undocumented remote access trojan (RAT) that masquerades as the Windows Calculator app as part of a conscious effort to stay under the radar.
Cybersecurity company Cybereason, which has been tracking the operations of the Iranian actor known as Moses Staff, dubbed the malware "StrifeWater."
"The StrifeWater RAT appears to be used in the initial stage of the attack and this stealthy RAT has the ability to remove itself from the system to cover the Iranian group's tracks," Tom Fakterman, Cybereason security analyst, said in a report. "The RAT possesses other capabilities, such as command execution and screen capturing, as well as the ability to download additional extensions."
Moses Staff came to light towards the end of last year when Check Point Research unmasked a series of attacks aimed at Israeli organizations since September 2021 with the objective of disrupting the targets' business operations by encrypting their networks, with no option to regain access or negotiate a ransom.
The intrusions were notable for the fact that they relied on the open-source library DiskCryptor to perform volume encryption, in addition to infecting the systems with a bootloader that prevents them from starting without the correct encryption key.
To date, victims have been reported beyond Israel, including Italy, India, Germany, Chile, Turkey, the U.A.E., and the U.S.
The new piece of the attack puzzle discovered by Cybereason comes in the form of a RAT that's deployed under the name "calc.exe" (the Windows Calculator binary) and is used during the early stages of the infection chain, only to be removed prior to the deployment of the file-encrypting malware.
The removal and the subsequent replacement of the malicious calculator executable with the legitimate binary, the researchers suspect, is an attempt on the part of the threat actor to cover up tracks and erase evidence of the trojan, not to mention enable them to evade detection until the final phase of the attack when the ransomware payload is executed.
StrifeWater, for its part, is no different from its counterparts and comes with numerous features, chief among them being the ability to list system files, execute system commands, take screen captures, create persistence, and download updates and auxiliary modules.
"The end goal for Moses Staff appears to be more politically motivated rather than financial," Fakterman concluded. "Moses Staff employs ransomware post-exfiltration not for financial gain, but to disrupt operations, obfuscate espionage activity, and to inflict damage to systems to advance Iran's geopolitical goals."
Related articles
- Hacking Tools Online
- What Are Hacking Tools
- Pentest Automation Tools
- Tools 4 Hack
- Hacking Tools Software
- Pentest Tools For Ubuntu
- Hacker Tool Kit
- Hacking Tools 2019
- Install Pentest Tools Ubuntu
- Tools For Hacker
- Hack Tools
- Best Hacking Tools 2019
- Best Hacking Tools 2020
- Hacker Tools 2020
- Pentest Recon Tools
- Hacker Tools 2020
- Game Hacking
- How To Hack
- Tools For Hacker
- Hacker Tools Github
- Hacking Tools For Windows Free Download
- Hacking App
- Hack Tools Pc
- Pentest Tools Port Scanner
- Hak5 Tools
- Beginner Hacker Tools
- Pentest Tools Review
- Hack Tools For Pc
- Hack Tools 2019
- Pentest Automation Tools
- Pentest Tools Website Vulnerability
- Hack Tools Pc
- Hacker Tools 2020
- Hack Tool Apk
- Hacking Tools 2019
- Hacking Tools Software
- Hacking Tools Download
- Hacking Tools Windows
- Best Hacking Tools 2020
- Hacker Tools Online
- Hack Tools 2019
- Black Hat Hacker Tools
- Pentest Box Tools Download
- Easy Hack Tools
- Hackrf Tools
- Hacker Search Tools
- Hacker Tools List
- Hacker Security Tools
- Pentest Tools Nmap
- Nsa Hacker Tools
- Pentest Tools Download
- Hack Tools For Mac
- Hacking Tools For Pc
- Pentest Tools For Android
- Pentest Tools For Android
- Hacker Tools Online
- Ethical Hacker Tools
- What Is Hacking Tools
- Tools Used For Hacking
- Pentest Tools For Android
- Hacking Tools Pc
- Game Hacking
- Pentest Tools Website Vulnerability
- Pentest Tools Tcp Port Scanner
- Hacker Security Tools
- Growth Hacker Tools
- New Hack Tools
- Growth Hacker Tools
- Hacking Apps
- Hacker Hardware Tools
- Game Hacking
- Hackrf Tools
- Pentest Tools
- Hacker Tools For Mac
- Hacking Tools Software
- What Are Hacking Tools
- Pentest Tools Website Vulnerability
- Pentest Tools For Ubuntu
- Pentest Tools Github
- Hacker Tools Windows
- Kik Hack Tools
- Pentest Recon Tools
- Game Hacking
- Hacking Tools 2019
- Pentest Tools Free
- Hacking Tools Pc
- Pentest Reporting Tools
- Hack Tool Apk
- Hacker Tools For Pc
- Hack Tools For Pc
Nenhum comentário:
Postar um comentário