Skip to main content
عربي
logo

NCSC-TAD-2209-003

Severity Level: Low
Malware

Reference No.: NCSC-TAD-2209-003CVSS 0

New Threat Actor Targeting Middle East

Threat Type:
N/A
TLP:
CLEAR
CVE:
N/A

Overview

Metador is a recent advanced threat actor that is targeting organizations in Middle East and Africa through two complex Windows-based malwares ‘metaMain’ and ‘Mafalda’ which loaded in the memory by utilizing "cdb.exe" Windows debugging tool. The use of attack infrastructure Living-off-the Land Binary (LoLBins) to decrypt and load a malware that runs entirely in memory and leaving no unencrypted trace with using a single IP address per victim allow the threat actor to stay hidden on victim networks and accomplish long-term persistence without raising the suspicion of a compromise. Mafalda accepts up to 67 commands including file operations, reading directories contents, manipulate the registry, reconnaissance of the network and the system, and exfiltrating data to the Command and Control (C2) server, while metaMain is utilized for hands-on operations, such as taking screenshots, performing file actions, logging keyboard events, and supports arbitrary shellcode execution. Analysts also found ‘Cryshell’ used for internal network bouncing besides indicators belonging to an unnamed Linux tool that steals data from workstations and channels them back to Mafalda. Researchers believe that behind Metador is "a high-end contractor arrangement," like one typical for a nation-state operation.

Mitigation and Immediate Actions

  1. 01

    Educate users on malware threats—train your users on techniques that can help them avoid social engineering schemes, such as phishing attacks, and report suspicious communication or system behavior to the security team.

  2. 02

    Strong passwords and software updates—ensure all users create strone, unique passwords, and regularly change passwords. Use a password manager to make it easier for users to use and remember secure passwords. Update your systems as quickly, as security flaws become known and patches are released.

  3. 03

    Back up your data and your test restore procedures—backup is a critical practice that can help to protect against data loss. It can help ensure that normal operations can be maintained even if the organization is attacked by network-based ransomware worms or other destructive cyber attacks.

  4. 04

    Partition your network—you should use network segmentation to isolate important parts of your network from each other. This can significantly reduce the “blast radius” of successful attacks, because attackers will be limited to a specific network segment and cannot move laterally to other parts of the network.

  5. 05

    Implement a layered security approach, including a secure email solution, a company-sanctioned file-sharing solution, and endpoint protection on user devices.

  6. 06

    Continuously monitor network traffic.

  7. 07

    Deploy a zero-trust security framework.

References

Impacted Sectors

  • ICT