With the use of these compromised accounts, the group can persist inside the targeted organizations, increase the legitimacy and efficacy of their spear-phishing attempts, and avoid detection by blending in with normal network traffic. The most recent attack chains operate similarly, using hacked email accounts associated with reputable businesses to send spear-phishing messages that point to an Egnyte subdomain—which has been exploited by threat actors in the past to spread Atera Agent—either directly or through a PDF attachment.

BugSleep, also known as MuddyRot, is an x64 implant written in C with the ability to initiate a reverse shell, download and upload any file to and from the compromised host, and establish persistence. A raw TCP socket on port 443 is used for communications with a command-and-control (C2) server. The victim host fingerprint, which consists of the hostname and username connected by a slash, is the first message to be transmitted to the C2. The software terminates if the victim receives a '-1,' but if not, the malware starts an endless loop in which it waits for the C2 to issue new commands.

Although the reason behind MuddyWater's switch to a custom implant is presently unknown, it's thought that security vendors' heightened observation of RMM tools may have contributed. MuddyWater's heightened activity in the Middle East, especially in Israel, emphasizes how tenacious these threat actors are in their pursuit of a wide range of regional objectives. They've been using phishing attacks consistently, and the addition of a proprietary backdoor, BugSleep, to their arsenal of techniques, tactics, and procedures (TTPs) is a noteworthy advance.

Impact

• Command Execution
• Cyber Espionage
• Sensitive Data Theft

Indicators of Compromise

IP

• 91.235.234.202
• 146.19.143.14
• 85.239.61.97

MD5

• a50a20edddaded453410600549968914
• c17f4bb8e415e21e6010b98e13c6dff3
• d783001d1f98fe3b33e7b97b0b7d96dc
• a713e686fd984588a4db74f34bf32275
• e7df84a5a22aeafcf1c3abf4fd986c91

SHA-256

• 94278fa01900fdbfb58d2e373895c045c69c01915edc5349cd6f3e5b7130c472
• b8703744744555ad841f922995cef5dbca11da22565195d05529f5f9095fbfca
• 73c677dd3b264e7eb80e26e78ac9df1dba30915b5ce3b1bc1c83db52b9c6b30e
• 960d4c9e79e751be6cad470e4f8e1d3a2b11f76f47597df8619ae41c96ba5809
• 5df724c220aed7b4878a2a557502a5cefee736406e25ca48ca11a70608f3a1c0

SHA-1

• d76e5ac85cd57425dc3c5dc27c438b0725d6eaa4
• e2bee0b9a6e262daa4842245e469f5a0310da868
• b99d3ac574d6611c7304ef87e9c51c187bb5dd42
• dfaae4c2ac9a19d2ef0fde43b6786a01b39b5521
• 72775239683ea6a651b5c73d2e3ed006af5e1cad

Remediation

• Block all threat indicators at your respective controls.
• Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Enable antivirus and anti-malware software and update signature definitions promptly. Using multi-layered protection is necessary to secure vulnerable assets.
• Patch and upgrade any platforms and software timely and make it into a standard security policy.
• Employ network intrusion detection and prevention systems to monitor and block malicious network activities.
• Implement network segmentation to limit lateral movement for attackers within the network.
• Implement advanced email filtering to detect and block phishing emails.
• Employ updated and robust endpoint protection solutions to detect and block malware.
• Develop and test an incident response plan to ensure a swift and effective response to security incidents.
• Enhance logging and monitoring capabilities to detect anomalous activities and unauthorized access.
• Conduct regular security audits and penetration testing to identify and address potential vulnerabilities.
• Regularly back up critical data and ensure that backup and recovery procedures are in place.