MuddyWater-Style Hackers Scan 12,000+ Systems Before Hitting Middle East Critical Sectors

The article discusses a recent cyber attack campaign attributed to MuddyWater, an Iran-based threat actor group. Here are the key points:

1. Initial Reconnaissance: The attackers conducted extensive reconnaissance on over 12,000 systems in Middle Eastern countries before launching targeted attacks.

2. Exploited Vulnerabilities:

   • CVE-2023-27549 (Exchange Server)
   • CVE-2022-41082
   • CVE-2022-41040
   • CVE-2022-41083
   • CVE-2022-41073

3. Attack Vectors:

   • The attackers used brute-force attacks to gain initial access via Office Web Access (OWA).
   • They then exploited the aforementioned vulnerabilities in Exchange Server.

4. Command and Control (C2) Communication:

   • The attackers employed a mix of HTTP, HTTPS, and custom protocols for C2 communications.
   • Advanced HTTP-based controllers managed encrypted client sessions through API-style endpoints like /command, /result, /signup, and /feed.
   • Go

Read the full article at Cyber Security News

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.