A politically motivated hacker group tied to a series of espionage and sabotage attacks on Israeli entities in 2021 incorporated a previously undocumented remote access trojan (RAT) that masquerades as the Windows Calculator app as part of a conscious effort to stay under the radar.
Cybersecurity company Cybereason, which has been tracking the operations of the Iranian actor known as Moses Staff, dubbed the malware "StrifeWater."
"The StrifeWater RAT appears to be used in the initial stage of the attack and this stealthy RAT has the ability to remove itself from the system to cover the Iranian group's tracks," Tom Fakterman, Cybereason security analyst, said in a report. "The RAT possesses other capabilities, such as command execution and screen capturing, as well as the ability to download additional extensions."
Moses Staff came to light towards the end of last year when Check Point Research unmasked a series of attacks aimed at Israeli organizations since September 2021 with the objective of disrupting the targets' business operations by encrypting their networks, with no option to regain access or negotiate a ransom.
The intrusions were notable for the fact that they relied on the open-source library DiskCryptor to perform volume encryption, in addition to infecting the systems with a bootloader that prevents them from starting without the correct encryption key.
To date, victims have been reported beyond Israel, including Italy, India, Germany, Chile, Turkey, the U.A.E., and the U.S.
The new piece of the attack puzzle discovered by Cybereason comes in the form of a RAT that's deployed under the name "calc.exe" (the Windows Calculator binary) and is used during the early stages of the infection chain, only to be removed prior to the deployment of the file-encrypting malware.
The removal and the subsequent replacement of the malicious calculator executable with the legitimate binary, the researchers suspect, is an attempt on the part of the threat actor to cover up tracks and erase evidence of the trojan, not to mention enable them to evade detection until the final phase of the attack when the ransomware payload is executed.
StrifeWater, for its part, is no different from its counterparts and comes with numerous features, chief among them being the ability to list system files, execute system commands, take screen captures, create persistence, and download updates and auxiliary modules.
"The end goal for Moses Staff appears to be more politically motivated rather than financial," Fakterman concluded. "Moses Staff employs ransomware post-exfiltration not for financial gain, but to disrupt operations, obfuscate espionage activity, and to inflict damage to systems to advance Iran's geopolitical goals."
Related links
- Pentest Tools Subdomain
- Hack Tools
- Hak5 Tools
- Hack Tools Mac
- Hacking Tools For Windows
- Hack Tool Apk No Root
- Hacking Tools For Windows
- Pentest Recon Tools
- Hacks And Tools
- Android Hack Tools Github
- Hacking Tools 2020
- Hacking App
- Hacking Tools And Software
- Hacking Tools Github
- Ethical Hacker Tools
- Hacking Tools Kit
- Pentest Tools For Windows
- How To Make Hacking Tools
- How To Hack
- Hacking Tools Github
- Pentest Tools Free
- Pentest Tools Nmap
- Physical Pentest Tools
- Pentest Tools For Android
- Hack Tools For Games
- Pentest Tools For Android
- Pentest Tools Android
- Hacker Tool Kit
- Hacker Tools Software
- Android Hack Tools Github
- Kik Hack Tools
- Hacking Tools Kit
- Pentest Reporting Tools
- Hacker Tools Free
- Free Pentest Tools For Windows
- Underground Hacker Sites
- New Hack Tools
- Hacking Tools For Games
- Hacker Tools Windows
- Growth Hacker Tools
- Hacker Tools Free
- Computer Hacker
- Hacker Security Tools
- Hacking Tools For Pc
- Pentest Recon Tools
- Android Hack Tools Github
- Hack Tools For Windows
- Pentest Tools Framework
- Hack Tools Mac
- Hacker Tools Online
- Hacker Hardware Tools
- Pentest Tools Framework
- Hacker Tool Kit
- Pentest Tools Port Scanner
- Hacking Tools 2020
- Hak5 Tools
- Hacking Tools Windows
- Black Hat Hacker Tools
- Hacker Tools 2019
- Bluetooth Hacking Tools Kali
- Hacker Tools Mac
- Hack Apps
- Pentest Tools For Mac
- Game Hacking
- Pentest Tools Online
- Termux Hacking Tools 2019
- Hacker Tools For Pc
- Pentest Tools Windows
- Hacker Tools Apk
- Hack Tools Pc
- Hacker
- Pentest Tools Apk
- Pentest Tools Website
- Hack Tools Mac
- Pentest Tools Github
- Hack Tools Mac
- Kik Hack Tools
- Hacker
- Pentest Tools Android
- Hacking Tools For Kali Linux
- Hacking App
- Easy Hack Tools
- Hacker Tools 2020
- Hacker Tools Hardware
- Hacker Tools Windows
- Pentest Tools Linux
- Best Hacking Tools 2019
- Hackers Toolbox
- Tools 4 Hack
- Pentest Tools Review
- Hacking Tools Online
- Hack Tools 2019
- Computer Hacker
- Hacking Tools For Windows Free Download
- Hacking Tools Pc
- Hack Tools Online
- Pentest Tools Tcp Port Scanner
- Best Hacking Tools 2020
- Hacker Tools Apk
- Tools For Hacker
- Hacking Tools Free Download
- Pentest Tools Port Scanner
- Physical Pentest Tools
- Hacking Tools Windows
- Blackhat Hacker Tools
- Hacker Tools Mac
- Hack App
- Hacking Tools For Windows 7
- World No 1 Hacker Software
- Pentest Tools Linux
- Hack Tools Online
- Hacking Tools Usb
- Hack Tools
- Hacker Tools Apk Download
- Pentest Tools For Windows
- Hacking Tools Free Download
- Hack Tools Download
- Hack Tools Download
- Hack Tools 2019
- Github Hacking Tools
- Pentest Tools Linux
- New Hacker Tools
- Pentest Tools Tcp Port Scanner
- Hacking Tools For Windows 7
- Pentest Tools Nmap
- What Is Hacking Tools
- Hack Tools For Ubuntu
- Hacking Tools Usb
- Hacking Tools Windows
- Hacker Search Tools
- Hacking Tools For Pc
- Pentest Tools For Android
- Computer Hacker
- Hacking Tools Windows
- Hack Tools
- Hack Tools For Mac
- Hack App
- Hacking Tools For Games
No comments:
Post a Comment