A politically motivated hacker group tied to a series of espionage and sabotage attacks on Israeli entities in 2021 incorporated a previously undocumented remote access trojan (RAT) that masquerades as the Windows Calculator app as part of a conscious effort to stay under the radar.
Cybersecurity company Cybereason, which has been tracking the operations of the Iranian actor known as Moses Staff, dubbed the malware "StrifeWater."
"The StrifeWater RAT appears to be used in the initial stage of the attack and this stealthy RAT has the ability to remove itself from the system to cover the Iranian group's tracks," Tom Fakterman, Cybereason security analyst, said in a report. "The RAT possesses other capabilities, such as command execution and screen capturing, as well as the ability to download additional extensions."
Moses Staff came to light towards the end of last year when Check Point Research unmasked a series of attacks aimed at Israeli organizations since September 2021 with the objective of disrupting the targets' business operations by encrypting their networks, with no option to regain access or negotiate a ransom.
The intrusions were notable for the fact that they relied on the open-source library DiskCryptor to perform volume encryption, in addition to infecting the systems with a bootloader that prevents them from starting without the correct encryption key.
To date, victims have been reported beyond Israel, including Italy, India, Germany, Chile, Turkey, the U.A.E., and the U.S.
The new piece of the attack puzzle discovered by Cybereason comes in the form of a RAT that's deployed under the name "calc.exe" (the Windows Calculator binary) and is used during the early stages of the infection chain, only to be removed prior to the deployment of the file-encrypting malware.
The removal and the subsequent replacement of the malicious calculator executable with the legitimate binary, the researchers suspect, is an attempt on the part of the threat actor to cover up tracks and erase evidence of the trojan, not to mention enable them to evade detection until the final phase of the attack when the ransomware payload is executed.
StrifeWater, for its part, is no different from its counterparts and comes with numerous features, chief among them being the ability to list system files, execute system commands, take screen captures, create persistence, and download updates and auxiliary modules.
"The end goal for Moses Staff appears to be more politically motivated rather than financial," Fakterman concluded. "Moses Staff employs ransomware post-exfiltration not for financial gain, but to disrupt operations, obfuscate espionage activity, and to inflict damage to systems to advance Iran's geopolitical goals."
Related word- Tools Used For Hacking
- Hack Tools For Windows
- Hacker Tools For Mac
- Pentest Tools List
- Easy Hack Tools
- Hacker Tools Mac
- Pentest Tools Website Vulnerability
- Pentest Tools Linux
- Hak5 Tools
- Game Hacking
- Beginner Hacker Tools
- Hacking Apps
- Hacking Tools Hardware
- Hacker Tools 2019
- Pentest Tools For Mac
- Hacker Tools Online
- Hacking Tools For Kali Linux
- Hacking Tools Windows 10
- Pentest Tools Subdomain
- Hack Tools Mac
- Hacking Tools Kit
- Pentest Tools Website Vulnerability
- What Is Hacking Tools
- Pentest Reporting Tools
- Pentest Tools Framework
- Hacker Tools For Mac
- Hacking Tools For Beginners
- Hacking Apps
- Hacker Tools For Pc
- Hacking Tools Download
- Hack Tools For Mac
- Hacker Security Tools
- Game Hacking
- Pentest Tools Free
- Hacking Tools For Beginners
- Pentest Tools For Android
- Pentest Tools Tcp Port Scanner
- Termux Hacking Tools 2019
- Hacker Hardware Tools
- Hacking Tools And Software
- Pentest Tools
- Pentest Tools Review
- What Is Hacking Tools
- Hacking Tools Online
- Pentest Tools Subdomain
- Bluetooth Hacking Tools Kali
- Hack Tools For Mac
- Beginner Hacker Tools
- What Are Hacking Tools
- Pentest Tools Linux
- Pentest Tools List
- Pentest Tools Url Fuzzer
- Install Pentest Tools Ubuntu
- Termux Hacking Tools 2019
- Hacker Tools Linux
- Hack Rom Tools
- Hacking Tools Download
- Hacker Tools Online
- Nsa Hack Tools
- Usb Pentest Tools
- Pentest Tools Apk
- Tools For Hacker
- Nsa Hack Tools Download
- Hacking Tools For Windows 7
- Top Pentest Tools
- Pentest Tools Apk
- How To Install Pentest Tools In Ubuntu
- Pentest Tools Android
- Hacking Tools And Software
- Growth Hacker Tools
- Pentest Tools Nmap
- Pentest Tools Github
- Hacking Tools For Beginners
- Hacker Tools Free
- Top Pentest Tools
- How To Install Pentest Tools In Ubuntu
- Pentest Tools Port Scanner
- Hacking Tools Mac
- Pentest Tools List
- Hacker Hardware Tools
- Pentest Tools Apk
- Hacker Tools
- Hacker Tools Software
- Hacker Techniques Tools And Incident Handling
- Hacking Tools Mac
- Github Hacking Tools
- Hacker Tools Windows
- Hacking App
- Pentest Tools For Mac
- Hacking Tools Download
- Pentest Tools Apk
- How To Make Hacking Tools
- Nsa Hack Tools Download
- Free Pentest Tools For Windows
- Tools 4 Hack
- Hacker Tools For Ios
- Pentest Tools For Windows
0 comentários:
Postar um comentário