The article discusses a recent cyber attack campaign attributed to MuddyWater, an Iran-based threat actor group. Here are the key points:
-
Initial Reconnaissance: The attackers conducted extensive reconnaissance on over 12,000 systems in Middle Eastern countries before launching targeted attacks.
-
Exploited Vulnerabilities:
- CVE-2023-27549 (Exchange Server)
- CVE-2022-41082
- CVE-2022-41040
- CVE-2022-41083
- CVE-2022-41073
-
Attack Vectors:
- The attackers used brute-force attacks to gain initial access via Office Web Access (OWA).
- They then exploited the aforementioned vulnerabilities in Exchange Server.
-
Command and Control (C2) Communication:
- The attackers employed a mix of HTTP, HTTPS, and custom protocols for C2 communications.
- Advanced HTTP-based controllers managed encrypted client sessions through API-style endpoints like /command, /result, /signup, and /feed.
- Go
Read the full article at Cyber Security News
Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.

![[AINews] The Unreasonable Effectiveness of Closing the Loop](/_next/image?url=https%3A%2F%2Fmedia.nemati.ai%2Fmedia%2Fblog%2Fimages%2Farticles%2F600e22851bc7453b.webp&w=3840&q=75)



