Article Content Summary This blog discusses targeted attacks against the Middle East taking place between February and October 2017 by a group Unit 42 is naming “MuddyWater” This blog links this recent activity with previous isolated public reporting on similar attacks we believe are related We refer to these attacks as MuddyWater due to the confusion in attributing these attacks The MuddyWater attacks are primarily against Middle Eastern nations However, we have also observed attacks against surrounding nations and beyond, including targets in India and the USA MuddyWater attacks are characterized by the use of a slowly evolving PowerShell-based first stage backdoor we call “POWERSTATS” Despite broad scrutiny and reports on MuddyWater attacks, the activity continues with only incremental changes to the tools and techniques Introduction & Overview The Palo Alto Networks Unit 42 research team recently came across a series of malicious files which were almost identical to those targeting the Saudi Arabian government previously discussed by MalwareBytes Which in turn, closely resembles a previous article by Morphisec These attacks have also been tracked by several other researchers on Twitter and elsewhere The activity has been consistent throughout 2017 and, based on our analysis, targets or is suspected to target, entities in the following countries:  Saudi Arabia Iraq Israel United Arab Emirates Georgia India Pakistan Turkey USA  The malicious documents were adjusted according to the target regions, often using the logos of branches of local government, prompting the users to bypass security controls and enable macros An overview of the technical changes seen in the past year is given in the graphic below, note that raw IOCs present in this graphic can be found as text in the Appendix at the end of this article Figure 1 An overview of the delivery of POWERSTATS, C2 URLs used, and other changes in the malware  MuddyWater in the Middle East The attackers behind MuddyWater have been active throughout 2017, with targets across the Middle East and surrounding areas, examples of the decoy documents observed is given in Table 1 Of course, being named in a decoy document doesn’t mean any of these organizations have been attacked themselves or are involved in the attacks: the MuddyWater actors are abusing the trust these organizations’ names and/or logos command for their malicious purposes All of these documents we observed and outlined above are related via:  Shared C2 infrastructure Shared attributes of the malicious documents used in attacks Shared attributes as to how the documents were delivered Based on these connections we can be confident that all the files and infrastructure we give in our appendices are related, since more than one of these can be used to link each of the samples discussed in each case The tools used by the MuddyWater attackers have been well documented by the previously cited research and a common theme of previous reporting was the open source nature of much of the toolset used by MuddyWater: Meterpreter, Mimikatz, Lazagne, Invoke-Obfuscation etc
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content Summary This blog discusses targeted attacks against the Middle East taking place between February and October 2017 by a group Unit 42 is naming “MuddyWater” This blog links this recent activity with previous isolated public reporting on similar attacks we believe are related We refer to these attacks as MuddyWater due to the confusion in attributing these attacks The MuddyWater attacks are primarily against Middle Eastern nations However, we have also observed attacks against surrounding nations and beyond, including targets in India and the USA MuddyWater attacks are characterized by the use of a slowly evolving PowerShell-based first stage backdoor we call “POWERSTATS” Despite broad scrutiny and reports on MuddyWater attacks, the activity continues with only incremental changes to the tools and techniques Introduction & Overview The Palo Alto Networks Unit 42 research team recently came across a series of malicious files which were almost identical to those targeting the Saudi Arabian government previously discussed by MalwareBytes Which in turn, closely resembles a previous article by Morphisec These attacks have also been tracked by several other researchers on Twitter and elsewhere The activity has been consistent throughout 2017 and, based on our analysis, targets or is suspected to target, entities in the following countries:  Saudi Arabia Iraq Israel United Arab Emirates Georgia India Pakistan Turkey USA  The malicious documents were adjusted according to the target regions, often using the logos of branches of local government, prompting the users to bypass security controls and enable macros An overview of the technical changes seen in the past year is given in the graphic below, note that raw IOCs present in this graphic can be found as text in the Appendix at the end of this article Figure 1 An overview of the delivery of POWERSTATS, C2 URLs used, and other changes in the malware  MuddyWater in the Middle East The attackers behind MuddyWater have been active throughout 2017, with targets across the Middle East and surrounding areas, examples of the decoy documents observed is given in Table 1 Of course, being named in a decoy document doesn’t mean any of these organizations have been attacked themselves or are involved in the attacks: the MuddyWater actors are abusing the trust these organizations’ names and/or logos command for their malicious purposes All of these documents we observed and outlined above are related via:  Shared C2 infrastructure Shared attributes of the malicious documents used in attacks Shared attributes as to how the documents were delivered Based on these connections we can be confident that all the files and infrastructure we give in our appendices are related, since more than one of these can be used to link each of the samples discussed in each case The tools used by the MuddyWater attackers have been well documented by the previously cited research and a common theme of previous reporting was the open source nature of much of the toolset used by MuddyWater: Meterpreter, Mimikatz, Lazagne, Invoke-Obfuscation etc ### Response: .