NCSC-TAD-2111-003
الرقم المرجعي: NCSC-TAD-2111-003CVSS 0
MuddyWater's Phishing Campaign Targets the Middle East
- نوع التهديد:
- غير متوفر
- مستوى المشاركة (TLP):
- CLEAR
- CVE:
- غير متوفر
نظرة عامة
Several Bahraini organizations have reported receiving phishing emails assessed as highly related to the Iranian threat group MuddyWater. The campaign uses spearphishing emails and lure documents containing embedded URLs to distribute remote administration tools, including ScreenConnect and RemoteUtilities. The attackers also deploy a remote access tool called “out1.exe”, use “Browser64.exe” to extract credentials, and establish a PowerShell backdoor for command execution and communication with command-and-control servers.
التقنيات المتأثرة
- ScreenConnect and RemoteUtilities
- Windows systems
- PowerShell
- Outlook and Chrome
إجراءات الحد من المخاطر والإجراءات الفورية
- 01
Email content filtering. Whitelist allowed attachment types (including archives and nested archives). Analyse/sanitize hyperlinks, PDF, and Microsoft Office attachments. Quarantine Microsoft Office macros.
- 02
Application whitelisting of approved/trusted programs to prevent execution of unapproved/malicious programs including .exe, DLL, scripts.
- 03
User application hardening. Configure web browsers to block Flash (ideally uninstall it), ads, and Java on the Internet.
- 04
Web content filtering. Whitelist allowed types of web content and websites with good reputation ratings. Block access to malicious domains and IP addresses, ads, anonymity networks, and free domains.
- 05
Protect your workstations and servers. We continue to encourage customers to follow our Protect Your Computer guidance of enabling a firewall, getting software updates, and installing antivirus software.