NCSC-TAD-2510-001
الرقم المرجعي: NCSC-TAD-2510-001CVSS 0
MuddyWater Deploys Phoenix Against Government Entities
- نوع التهديد:
- غير متوفر
- مستوى المشاركة (TLP):
- CLEAR
- CVE:
- غير متوفر
نظرة عامة
MuddyWater used a compromised mailbox to send malicious documents to Government entities and international organizations across the Middle East and North Africa. The documents contained macros that deployed FakeUpdate and the Phoenix v4 backdoor, enabling persistent access, remote command execution, and intelligence gathering.
التقنيات المتأثرة
- Microsoft Word
إجراءات الحد من المخاطر والإجراءات الفورية
- 01
Scan documents and test them in an isolated environment before users open them.
- 02
Conduct regular phishing simulations and awareness training for personnel, emphasizing “enable content” macro lures.
- 03
Disable Office macros by default through Group Policy and allow execution only from signed or trusted sources.
- 04
Enforce Multi-Factor Authentication (MFA) across all accounts to prevent unauthorized mailbox access.