According to researchers Ryan Tomcik, Emiel Haeghebaert and Tufail Ahmed, “UNC3313 conducts surveillance and collects strategic information to support Iranian interests and decision-making. Targeting patterns and related lures show a strong focus on geopolitical targets.”
In November 2021, an Iranian geopolitical nexus threat actor was discovered deploying two new targeted malware with “simple” backdoor functionalities as part of an intrusion against an unnamed Middle East government entity.
Mandiant, a cybersecurity firm, attributed the attack to an uncategorized cluster it’s tracking under the moniker UNC3313, which it believes is associated with the MuddyWater state-sponsored group with “moderate confidence.”
MuddyWater was identified by US intelligence agencies in mid-January 2022 as a subordinate element of the Iranian Ministry of Intelligence and Security (MOIS) that has been active since at least 2018 and is known to use a wide range of tools and techniques in its operations.
The attacks are said to have begun with spear-phishing messages to gain initial access, followed by the use of publicly available offensive security tools and remote access software for lateral movement and access to the environment. The phishing emails were designed to entice victims to click a URL to download a RAR archive file hosted on OneHub, opening the way for the installation of ScreenConnect, a legitimate remote access software for gaining a foothold.
A previously unknown backdoor known as STARWHALE, a Windows Script File (.WSF) that executes commands received through HTTP from a hardcoded command-and-control (C2) server, was also discovered.
GRAMDOOR is another implant delivered during the attack, so named because it uses the Telegram API for network communications with the attacker-controlled server in order to avoid detection, emphasising the use of communication tools to facilitate data exfiltration.
The findings also coincide with a new joint advisory from cybersecurity agencies in the United Kingdom and the United States accusing the MuddyWater group of conducting global espionage attacks against the defence, local government, oil and natural gas, and telecommunications sectors.
Finally the researchers concluded that ,” UNC3313 moved quickly to establish remote access by infiltrating systems using ScreenConnect within an hour of initial compromise, adding that the security incident was quickly contained and resolved.
Indicators of Compromise
| Type | Value | Description |
| MD5 | 7c3564cd166822be4932986cb8158409 | CrackMapExec |
| MD5 | 7fefce7f2e4088ce396fd146a7951871 | LIGOLO |
| MD5 | 5763530f25ed0ec08fb26a30c04009f1 | GRAMDOOR |
| MD5 | 15fa3b32539d7453a9a85958b77d4c95 | GRAMDOOR |
| MD5 | cb84c6b5816504c993c33360aeec4705 | STARWHALE |
| MD5 | c8ff058db87f443c0b85a286a5d4029e | ScreenConnect |
| IP | 88.119.175[.]112 | LIGOLO C&C |
| IP | 95.181.161[.]50 | LIGOLO C&C |
| IP | 45.153.231[.]104 | LIGOLO C&C |
| IP | 95.181.16[.]81 | Malware/Tools Hosting |
| IP | 5.199.133[.]149 | STARWHALE C&C |
| IP | 45.142.213[.]17 | STARWHALE C&C |
| IP | 87.236.212[.]184 | STARWHALE.GO C&C |
–-For more Cyber security news in crisp content . Please follow our site via twitter handle @cyberworkx1, Linkedin handle @linkedin
CyberWorkx 