Destructive Attacks by MuddyWater and DEV-1084

An Iranian nation-state Advanced Persistent Threat (APT) MuddyWater in partnership with DEV-1084 has been observed conducting destructive attacks on hybrid environments targeting Middle East. The attack starts when MuddyWater gains initial access to the target environment by exploiting known unpatched vulnerabilities consequently the DEV-1084 conducts destructive actions such as performing extensive reconnaissance and discovery, establishing persistence, and moving laterally throughout the network. DEV-1084 relay on compromised credentials to escalate the privileges to perform encryption of on-premises devices and large-scale deletion of cloud resources, including server farms, virtual machines, storage accounts, and virtual networks. Through Exchange Web Services, threat actors can acquire complete access to email inboxes, doing thousands of search activities and impersonating an anonymous high-ranking employee to send messages to both internal and external recipients.