A politically motivated hacker group tied to a series of espionage and sabotage attacks on Israeli entities in 2021 incorporated a previously undocumented remote access trojan (RAT) that masquerades as the Windows Calculator app as part of a conscious effort to stay under the radar.
Cybersecurity company Cybereason, which has been tracking the operations of the Iranian actor known as Moses Staff, dubbed the malware "StrifeWater."
"The StrifeWater RAT appears to be used in the initial stage of the attack and this stealthy RAT has the ability to remove itself from the system to cover the Iranian group's tracks," Tom Fakterman, Cybereason security analyst, said in a report. "The RAT possesses other capabilities, such as command execution and screen capturing, as well as the ability to download additional extensions."
Moses Staff came to light towards the end of last year when Check Point Research unmasked a series of attacks aimed at Israeli organizations since September 2021 with the objective of disrupting the targets' business operations by encrypting their networks, with no option to regain access or negotiate a ransom.
The intrusions were notable for the fact that they relied on the open-source library DiskCryptor to perform volume encryption, in addition to infecting the systems with a bootloader that prevents them from starting without the correct encryption key.
To date, victims have been reported beyond Israel, including Italy, India, Germany, Chile, Turkey, the U.A.E., and the U.S.
The new piece of the attack puzzle discovered by Cybereason comes in the form of a RAT that's deployed under the name "calc.exe" (the Windows Calculator binary) and is used during the early stages of the infection chain, only to be removed prior to the deployment of the file-encrypting malware.
The removal and the subsequent replacement of the malicious calculator executable with the legitimate binary, the researchers suspect, is an attempt on the part of the threat actor to cover up tracks and erase evidence of the trojan, not to mention enable them to evade detection until the final phase of the attack when the ransomware payload is executed.
StrifeWater, for its part, is no different from its counterparts and comes with numerous features, chief among them being the ability to list system files, execute system commands, take screen captures, create persistence, and download updates and auxiliary modules.
"The end goal for Moses Staff appears to be more politically motivated rather than financial," Fakterman concluded. "Moses Staff employs ransomware post-exfiltration not for financial gain, but to disrupt operations, obfuscate espionage activity, and to inflict damage to systems to advance Iran's geopolitical goals."
Related news
- Hacker Tools Free
- Hacker Tools For Ios
- Hacking Tools Hardware
- Pentest Box Tools Download
- Hacker Tool Kit
- Android Hack Tools Github
- Hacking Tools Free Download
- Best Hacking Tools 2019
- Hacking Tools For Games
- Hacker Tools Apk
- Hackers Toolbox
- Hacking Tools For Games
- Hack Tools Pc
- Hacking Tools Name
- Hacking Tools Name
- Hack Tools Github
- Hacking Tools Online
- Usb Pentest Tools
- Pentest Tools For Android
- Hacking Tools Kit
- Hacker Tools List
- Install Pentest Tools Ubuntu
- Hack Tools
- Best Hacking Tools 2020
- Hack Tools Download
- Hacker Tools For Windows
- Hack App
- Pentest Tools Find Subdomains
- Wifi Hacker Tools For Windows
- Hacker Tools Hardware
- Hacker Tools Windows
- Hack Tools Download
- Pentest Tools For Mac
- Hack Apps
- Pentest Tools Online
- Best Hacking Tools 2019
- Kik Hack Tools
- Hacker Search Tools
- Hacker Tools List
- Pentest Tools Alternative
- Hack Tools For Games
- Pentest Tools For Windows
- Hacking Tools Software
- Pentest Tools For Android
- Nsa Hacker Tools
- Hacks And Tools
- Pentest Tools Bluekeep
- Hacker Tools Windows
- Pentest Tools For Mac
- Kik Hack Tools
- Hacker Tools
- Pentest Tools Website
- Nsa Hack Tools Download
- Tools 4 Hack
- Hacking Tools Name
- Nsa Hacker Tools
- Hacking Tools For Windows
- Nsa Hack Tools
- Wifi Hacker Tools For Windows
- Hack Tools For Games
- Nsa Hacker Tools
- Pentest Tools For Windows
- Hack Tool Apk
- Hacking Tools Usb
- Underground Hacker Sites
- Hacker Security Tools
- Hacker Tools Free
- Physical Pentest Tools
- Pentest Tools Kali Linux
- Growth Hacker Tools
- Hacking Tools Windows
- Hack Tools For Windows
- Pentest Tools Review
- Hacking Tools
- Hacking Tools Windows
- Hacking Tools Windows
- Hack Apps
- Hacker Tools Linux
- Hacker Tools For Windows
- Hacking Tools For Beginners
- Pentest Tools Free
- Hacking Tools For Mac
- World No 1 Hacker Software
- Hacking Tools For Windows Free Download
- Pentest Tools Tcp Port Scanner
- Pentest Tools Free
- Pentest Tools Free
- Usb Pentest Tools
- Pentest Tools Framework
- Pentest Tools Windows
- Pentest Tools Apk
- Ethical Hacker Tools
- Hackrf Tools
- Pentest Tools Subdomain
- Nsa Hack Tools
- Hacking Tools Pc
- Hack Tools For Windows
- Github Hacking Tools
- Hack And Tools
- Pentest Tools Framework
- Android Hack Tools Github
- Hacking Tools For Beginners
- Hacking Tools 2019
- Hacking Tools
- Hacker Tools Hardware
- Hacking Tools Windows 10
- Pentest Tools Github
- Hack Apps
- Hak5 Tools
- Hacker Tools List
- Pentest Tools For Android
- What Is Hacking Tools
- Pentest Recon Tools
- Physical Pentest Tools
- Hacking Tools For Pc
No comments:
Post a Comment