A politically motivated hacker group tied to a series of espionage and sabotage attacks on Israeli entities in 2021 incorporated a previously undocumented remote access trojan (RAT) that masquerades as the Windows Calculator app as part of a conscious effort to stay under the radar.
Cybersecurity company Cybereason, which has been tracking the operations of the Iranian actor known as Moses Staff, dubbed the malware "StrifeWater."
"The StrifeWater RAT appears to be used in the initial stage of the attack and this stealthy RAT has the ability to remove itself from the system to cover the Iranian group's tracks," Tom Fakterman, Cybereason security analyst, said in a report. "The RAT possesses other capabilities, such as command execution and screen capturing, as well as the ability to download additional extensions."
Moses Staff came to light towards the end of last year when Check Point Research unmasked a series of attacks aimed at Israeli organizations since September 2021 with the objective of disrupting the targets' business operations by encrypting their networks, with no option to regain access or negotiate a ransom.
The intrusions were notable for the fact that they relied on the open-source library DiskCryptor to perform volume encryption, in addition to infecting the systems with a bootloader that prevents them from starting without the correct encryption key.
To date, victims have been reported beyond Israel, including Italy, India, Germany, Chile, Turkey, the U.A.E., and the U.S.
The new piece of the attack puzzle discovered by Cybereason comes in the form of a RAT that's deployed under the name "calc.exe" (the Windows Calculator binary) and is used during the early stages of the infection chain, only to be removed prior to the deployment of the file-encrypting malware.
The removal and the subsequent replacement of the malicious calculator executable with the legitimate binary, the researchers suspect, is an attempt on the part of the threat actor to cover up tracks and erase evidence of the trojan, not to mention enable them to evade detection until the final phase of the attack when the ransomware payload is executed.
StrifeWater, for its part, is no different from its counterparts and comes with numerous features, chief among them being the ability to list system files, execute system commands, take screen captures, create persistence, and download updates and auxiliary modules.
"The end goal for Moses Staff appears to be more politically motivated rather than financial," Fakterman concluded. "Moses Staff employs ransomware post-exfiltration not for financial gain, but to disrupt operations, obfuscate espionage activity, and to inflict damage to systems to advance Iran's geopolitical goals."
Related news
- Hack App
- Hacker Tools Github
- Pentest Tools Online
- Best Hacking Tools 2020
- How To Make Hacking Tools
- How To Hack
- Hacking Tools Download
- Hacker Tools Online
- Hack And Tools
- Hacker Tools Mac
- Hacking Tools For Windows Free Download
- Termux Hacking Tools 2019
- Hack App
- Hacker Tools Windows
- Hacker Tools Free
- Hacker Techniques Tools And Incident Handling
- Hacking Tools Github
- Hack Tools 2019
- Hacking Tools Mac
- Computer Hacker
- Hacker
- Hacker Tools Apk Download
- Hacker Tools 2019
- Hack And Tools
- Hacker Tools Windows
- Best Pentesting Tools 2018
- Best Hacking Tools 2019
- Hacking Tools For Pc
- Hacking Tools Free Download
- Nsa Hack Tools
- Underground Hacker Sites
- Hack Tools 2019
- Pentest Tools Framework
- Hacker Tools Software
- Hacker Tools 2020
- Hacking Tools 2019
- Pentest Tools Website Vulnerability
- Hack Rom Tools
- Hacking Tools Usb
- Physical Pentest Tools
- Computer Hacker
- Hack App
- Hacking Tools Free Download
- Bluetooth Hacking Tools Kali
- World No 1 Hacker Software
- Hacker Techniques Tools And Incident Handling
- Hacking Tools Free Download
- Github Hacking Tools
- Hack Tools For Ubuntu
- Hacker Tools List
- Hacking Tools And Software
- Ethical Hacker Tools
- Hacking Tools Pc
- Best Hacking Tools 2019
- Hacker Tools Apk
- Hacker Tools Linux
- How To Make Hacking Tools
- Hacking Tools For Mac
- Hack Rom Tools
- Hacker Tools For Ios
- Hack Tools Github
- New Hack Tools
- Pentest Tools For Mac
- Hacker Tools Linux
- Pentest Tools Kali Linux
- Hacker Tools Windows
- Hack Tools For Ubuntu
- Hacking Tools Pc
- Pentest Tools Nmap
- Pentest Tools
- Pentest Tools Apk
- Pentest Tools Find Subdomains
- Pentest Tools For Mac
- Hack Tools For Games
- Hacking Tools Name
- Hacker Search Tools
- Hack Tools
- Hacks And Tools
- Tools 4 Hack
- Hacking Tools Kit
- Hacking Tools Name
- Hacking Tools For Beginners
- Hacking Tools For Windows
- Hacker Tools 2019
- Install Pentest Tools Ubuntu
- Hacking Tools For Games
- Pentest Tools Framework
- New Hacker Tools
- Black Hat Hacker Tools
- Hacker Tools Windows
- Pentest Tools Android
- Hacker Tools Github
- Pentest Tools List
- Nsa Hack Tools
- Hacking Tools
- Hacking Tools Github
- Hack Tools For Games
- Hacking Tools For Windows Free Download
- Hacking Tools For Windows 7
- Hack Rom Tools
- Tools 4 Hack
- Hacking Tools Software
- Hacker Tools Linux
- Hacking Tools And Software
- Hak5 Tools
- Hacking Tools Usb
- Nsa Hacker Tools
- Easy Hack Tools
- Hack Tools For Windows
- Hacker
- Hacker Tools Free
- Install Pentest Tools Ubuntu
- Easy Hack Tools
- Pentest Tools Free
- Hacking Apps
- Ethical Hacker Tools
- Hacker Tools 2020
- Free Pentest Tools For Windows
- Hacking App
- Hacking Tools For Games
- Install Pentest Tools Ubuntu
- Install Pentest Tools Ubuntu
- Hacker Tools List
- Pentest Tools Find Subdomains
- Hacking Tools For Kali Linux
- Hack Tools Github
- Hack Rom Tools
- Hacking Tools Pc
- Blackhat Hacker Tools
- Pentest Tools Github
- Hacker Tools 2019
- Pentest Tools Free
- Hacking Tools For Games
- Hacking Tools For Pc
- Growth Hacker Tools
- Nsa Hacker Tools
- Hacking Tools Download
- Hacker Tool Kit
- Hack Tools Download
- Install Pentest Tools Ubuntu
- Pentest Tools Github
- Hackers Toolbox
- Kik Hack Tools
- Beginner Hacker Tools
- Hacking Apps
- Hacking Tools For Kali Linux
- Install Pentest Tools Ubuntu
- Beginner Hacker Tools
- Pentest Tools Online
- Free Pentest Tools For Windows
- Nsa Hack Tools
- Pentest Tools Website Vulnerability
- Hacker
- Pentest Tools Port Scanner
- Pentest Tools Download
- Hacker Tools Free
- Pentest Tools Windows
- Tools 4 Hack
No comments:
Post a Comment