MuddyWater

MuddyWater has controlled POWERSTATS from behind a proxy network to obfuscate the C2 location.^[3] MuddyWater has used a series of compromised websites that victims connected to randomly to relay information to command and control (C2).^[6][9]

MuddyWater has disguised malicious executables and used filenames and Registry key names associated with Windows Defender.^[11][15][10]

MuddyWater has used a Word Template, Normal.dotm, for persistence.^[6]

MuddyWater has used AES to encrypt C2 responses.^[8]

MuddyWater maintains persistence on victim networks through side-loading dlls to trick legitimate programs into running malware.^[7]

MuddyWater has added Registry Run key KCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemTextEncoding to establish persistence.^{[11][14][15][6][9][8]}

MuddyWater has used PowerShell for execution.^{[11][16][14][3][4][15][6][9][7][8]}

MuddyWater can disable the system's local proxy settings.^[9]

MuddyWater has used HTTP for C2 communications.^[5][9]

MuddyWater has used the native Windows cabinet creation tool, makecab.exe, likely to compress stolen data to be uploaded.^[3]

MuddyWater has performed credential dumping with Mimikatz and procdump64.exe.^[2][3][9]

MuddyWater has stored a decoy PDF file within a victim's %temp% folder.^[8]

MuddyWater has used tools to encode C2 communications including Base64 encoding.^[5][9]

MuddyWater has run a tool that steals passwords saved in victim email.^[3]

MuddyWater has stored obfuscated JavaScript code in an image file named temp.jpg.^[4]

MuddyWater uses various techniques to bypass UAC.^[4]

MuddyWater has distributed URLs in phishing e-mails that link to lure documents.^[10][9][13]

MuddyWater has used CMSTP.exe and a malicious INF to execute its POWERSTATS payload.^[11]

MuddyWater has used web services including OneHub to distribute remote access tools.^[10]

MuddyWater has used file sharing services including OneHub, Sync, and TeraBox to distribute tools.^[10][9][13]

MuddyWater has used legitimate tools ConnectWise, RemoteUtilities, and SimpleHelp to gain access to the target environment.^[10][18]

MuddyWater has used cmd.exe net user /domain to enumerate domain users.^[9]

MuddyWater has used malware that has the capability to execute malicious code via COM, DCOM, and Outlook.^[14][5][7]

MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients.^{[2][11][14][5][10][9] [7][13]}

MuddyWater has used scheduled tasks to establish persistence.^[6]