In some of their recent attack documents, the attackers also used GitHub as a hosting site for their custom backdoor, POWERSTATS The POWERSTATS malware was compiled as an exe using PS2EXE However, this was a minor anomaly, as it was only seen in this case: raw scripts being used in all other cases Pwn one to pwn them all In some of the instances we observed what appeared to be compromised accounts at third party organizations sending the malware In one case, the attackers sent a malicious document which was nearly identical to a legitimate attachment which we observed later being sent to the same recipient FIN7 is a threat actor group that is financially motivated with targets in the restaurant, services and financial sectors Following the trail of existing public reporting, the tie to FIN7 is essentially made based on a download observed from a MuddyWater C2, of a non-public tool “DNSMessenger” For example, Morphisec wrote: “Later in our investigation, the same command server also delivered a variant of the DNS messenger similar to that described by Talos The use of the DNSMessenger tool appears primarily linked to FIN7, with no other samples being attributable to MuddyWater This led us to query the relationship between the newer attacks we were looking at and the alleged FIN7 link As part of this research, we came up with the following hypotheses along with their likelihoods, and a rationale for each one 1) The FIN7 threat actor is also involved in espionage in the Middle East – Unlikely Whilst this may seem an attractive hypothesis to some, there are aspects on the technical side that simply don’t add up Primarily, there are significant disparities between FIN7 and MuddyWater, specifically in terms of:  Malware unique to FIN7, or commonly used by them has not yet been seen in any MuddyWater investigations (except for the single observation of the DNSMessenger sample) Other non-public malware and tools used by MuddyWater have not been observed in our FIN7 investigations 2) The DNSMessenger malware is a shared tool, used by FIN7, MuddyWater and perhaps other groups – Unlikely We have attempted to find examples of code available in public data sources that would generate the variation of the DNSMessenger malware and had little luck in doing so Even though the code for DNSMessenger is publicly available following research into attackers published by 3rd parties, attackers would have to write the corresponding server side to use it, and as such they may well choose to use the public DNS_TXT_Pwnage.ps1 script instead Despite this, based on the chain of analysis above we cannot discount the notion that DNSMessenger is shared by multiple attackers, including FIN7 and MuddyWater 3) There was a mistake in the original Morphisec analysis which linked these attacks to FIN7 –  Possible Little detail is given on the nature of how the connection between DNSMessenger and MuddyWater was discovered it isn’t possible for us to verify this link 4) The attackers realized they were under investigation and planted a false flag – Possible The attackers realized they were under investigation and planted a false flag on their C2 server, uploading a copy of the FIN7 DNSMessenger code which had been previously mentioned (and was since publicly available) by FireEye and delivering it to researchers to trick them into mis-attributing the campaign Indeed, the sample shared by Morphisec on PasteBin is identical to the one dropped by the sample discussed in the FireEye FIN7 SEC campaign blog except for the final line Final thoughts Whilst we could conclude with confidence that the attacks discussed in this article are not FIN7 related, we were not able to answer many of our questions about the MuddyWater attacks We are currently unable to make a firm conclusion about the origin of the attackers, or the specific types of information they seek out once on a network In any case we will continue to track their activities to provide protections for our customers We hope the analysis presented shows the importance of drawing your own conclusions based on the data available to you, not just taking the conclusions given in the public domain at face value This is especially true when actors who rely on slightly modified (and publicly available) open source tools are in play Copycat threat actors can easily mimic attackers who use open source tools which can confuse attribution efforts meaning more than one aspect of the attacks observed must be considered when clustering On top of this, whilst the vast majority of threat analysis in the public domain is repeatable and correct, in some cases it can be difficult to verify the analysis available When it is hard to reproduce the analysis the confidence in any conclusions drawn must be lower than it would otherwise be, since you cannot know for sure that what is stated is true Palo Alto Networks customers are protected from this threat in the following ways:  WildFire and Traps detect all the malware supported in this report as malicious Traps customers can deploy Heuristic methods to detect attacks that use these techniques C2 domains used by the attackers are blocked via Threat Prevention 
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some of their recent attack documents, the attackers also used GitHub as a hosting site for their custom backdoor, POWERSTATS The POWERSTATS malware was compiled as an exe using PS2EXE However, this was a minor anomaly, as it was only seen in this case: raw scripts being used in all other cases Pwn one to pwn them all In some of the instances we observed what appeared to be compromised accounts at third party organizations sending the malware In one case, the attackers sent a malicious document which was nearly identical to a legitimate attachment which we observed later being sent to the same recipient FIN7 is a threat actor group that is financially motivated with targets in the restaurant, services and financial sectors Following the trail of existing public reporting, the tie to FIN7 is essentially made based on a download observed from a MuddyWater C2, of a non-public tool “DNSMessenger” For example, Morphisec wrote: “Later in our investigation, the same command server also delivered a variant of the DNS messenger similar to that described by Talos The use of the DNSMessenger tool appears primarily linked to FIN7, with no other samples being attributable to MuddyWater This led us to query the relationship between the newer attacks we were looking at and the alleged FIN7 link As part of this research, we came up with the following hypotheses along with their likelihoods, and a rationale for each one 1) The FIN7 threat actor is also involved in espionage in the Middle East – Unlikely Whilst this may seem an attractive hypothesis to some, there are aspects on the technical side that simply don’t add up Primarily, there are significant disparities between FIN7 and MuddyWater, specifically in terms of:  Malware unique to FIN7, or commonly used by them has not yet been seen in any MuddyWater investigations (except for the single observation of the DNSMessenger sample) Other non-public malware and tools used by MuddyWater have not been observed in our FIN7 investigations 2) The DNSMessenger malware is a shared tool, used by FIN7, MuddyWater and perhaps other groups – Unlikely We have attempted to find examples of code available in public data sources that would generate the variation of the DNSMessenger malware and had little luck in doing so Even though the code for DNSMessenger is publicly available following research into attackers published by 3rd parties, attackers would have to write the corresponding server side to use it, and as such they may well choose to use the public DNS_TXT_Pwnage.ps1 script instead Despite this, based on the chain of analysis above we cannot discount the notion that DNSMessenger is shared by multiple attackers, including FIN7 and MuddyWater 3) There was a mistake in the original Morphisec analysis which linked these attacks to FIN7 –  Possible Little detail is given on the nature of how the connection between DNSMessenger and MuddyWater was discovered it isn’t possible for us to verify this link 4) The attackers realized they were under investigation and planted a false flag – Possible The attackers realized they were under investigation and planted a false flag on their C2 server, uploading a copy of the FIN7 DNSMessenger code which had been previously mentioned (and was since publicly available) by FireEye and delivering it to researchers to trick them into mis-attributing the campaign Indeed, the sample shared by Morphisec on PasteBin is identical to the one dropped by the sample discussed in the FireEye FIN7 SEC campaign blog except for the final line Final thoughts Whilst we could conclude with confidence that the attacks discussed in this article are not FIN7 related, we were not able to answer many of our questions about the MuddyWater attacks We are currently unable to make a firm conclusion about the origin of the attackers, or the specific types of information they seek out once on a network In any case we will continue to track their activities to provide protections for our customers We hope the analysis presented shows the importance of drawing your own conclusions based on the data available to you, not just taking the conclusions given in the public domain at face value This is especially true when actors who rely on slightly modified (and publicly available) open source tools are in play Copycat threat actors can easily mimic attackers who use open source tools which can confuse attribution efforts meaning more than one aspect of the attacks observed must be considered when clustering On top of this, whilst the vast majority of threat analysis in the public domain is repeatable and correct, in some cases it can be difficult to verify the analysis available When it is hard to reproduce the analysis the confidence in any conclusions drawn must be lower than it would otherwise be, since you cannot know for sure that what is stated is true Palo Alto Networks customers are protected from this threat in the following ways:  WildFire and Traps detect all the malware supported in this report as malicious Traps customers can deploy Heuristic methods to detect attacks that use these techniques C2 domains used by the attackers are blocked via Threat Prevention  ### Response: .