A New Phishing Campaign By MuddyWater

MuddyWater a sponsored nation state Iranian threat actor, utilized compromised email accounts to deliver phishing emails to their targets. Observed targets were two Egyptian hosting companies, and multiple insurance companies in Israel. MuddyWater leveraged a remote administration tool (Syncro), that is designed for managed service providers (MSPs). The group targeted two Egyptian hosting companies, one was compromised to spread the phishing emails, the other was the recipient of the malicious message. The initial infection vector is phishing sent from a compromised legitimate business email account. To evade detection the threat actors attached an HTML file containing the URL to download the Syncro MSI installer. Once Syncro is installed on the target system, backdoors are deployed to gain persistance and exfilterate data.