✕
Request a Demo
Rewterz
Rewterz Threat Advisory – CVE-2021-44832 – Apache Log4j
December 29, 2021
Rewterz
Rewterz Threat Alert – SmokeLoader Malware – Active IOCs
December 29, 2021

Rewterz Threat Alert – MuddyWater APT Group – Active IOCs

Severity

High

Analysis Summary

The Iranian cybercriminal group MuddyWater has resurfaced. The group primarily has targeted Middle Eastern, European, and North American nations. The industries under target include telecommunications, government (IT services), and oil sectors. Most of the campaigns by MuddyWater are designed upon socially engineering their victims into enabling macros in order to infect the targeted workstation. Once macros were enabled, the threat actor-written code would attempt to obtain a trojan hosted on an adversarial payload command and control node.

advisory-1640756618.jpg

Impact

  • Credential Theft
  • Exposure of Sensitive Information

Indicators of Compromise

Filename

  • projectvpn[.]doc

IP

  • 192[.]227[.]147[.]152
  • 107[.]174[.]68[.]60

MD5

  • c9ab403bd43649b5fd57efac4bf83b7c
  • 748ae5af58e52e940ab806bdbbe61c4c
  • 5c0db4b48129acc977e26de7daed6b49

SHA-256

  • ea24c5a8b976919d4c8c4779dc0b7ef887373f126c4732edf9023b827b4e4dc4
  • 2f2492b7bb55f7a12f7530c9973c9b81fdd5e24001e4a21528ff1d5b47e3446e
  • 84d523833db6cc74a079b12312da775d4281bf1034b2af0203c9d14c098e6f29

SHA-1

  • d3d98b066011fea2f4f1b9eaab97b28591d50fbe
  • 202d003226eb71772701854af86e9e22eb41654f
  • 2021c163c7fcae8f4941ea50247ae3fa3eb1dde9

Remediation

  • Block all threat indicators at your respective controls.
  • Search for ICOs in your environment.
  • Always be suspicious about emails sent by unknown senders.
  • Never click on the links/attachments sent by unknown senders