Full Report
Huntress has identified and detailed a full timeline of an intrusion in a customer environment that aligns with what others have identified as MuddyWater (Iranian-linked APT).
Analysis Summary
# Threat Actor: MuddyWater
## Attribution & Identity
* **Actor Name:** MuddyWater
* **Aliases:** Static Kitten, MERCURY, Seedworm, TEMP.Zagros
* **Known Associations:** Linked to the Iranian government (Ministry of Intelligence and Security - MOIS).
* **Context:** Identified by Huntress and corroborated by reports from Group-IB and Hunt.io regarding Iranian-linked APT infrastructure.
## Activity Summary
* **Recent Campaign (January 2024):** An intrusion targeting an Israeli organization involving RDP access and a sophisticated execution chain.
* **Operation Olalampo:** Referenced historical activity involving specific infrastructure overlaps identified by Group-IB.
## Tactics, Techniques & Procedures
* **Initial Access:** Terminal Services/Remote Desktop Protocol (RDP) login (T1021.001).
* **Execution:** Manual command-line execution via `cmd.exe` and `powershell.exe`.
* **Defense Evasion:**
* **DLL Side-Loading (T1574.002):** Utilizing the legitimate `FMAPP.exe` (Fortemedia Inc.) to load a malicious `FMAPP.dll`.
* **Process Mimicry:** Opening fresh PowerShell sessions from Explorer to appear as legitimate interactive user sessions.
* **Command and Control:**
* **SSH Tunneling:** Establishing reverse SSH tunnels for persistent access and C2.
* **Connectivity Checks:** Using `ping` and `tasklist` to verify C2 status and malware execution.
* **Discovery:**
* Active reconnaissance using `whoami /priv` (T1033).
* Enumeration of domain and local groups using `net.exe` (T1069).
## Targeting
* **Sectors:** Technology, Government, and critical infrastructure (inferred from historical MuddyWater behavior).
* **Geography:** Primarily Israel (in this specific case) and the Middle East.
* **Victims:** An unnamed Israeli company.
## Tools & Infrastructure
* **Malware:** Malicious `FMAPP.dll` (Custom backdoor/loader).
* **Legitimate Binaries (LOLBins):** `ssh.exe` (OpenSSH), `FMAPP.exe`, `net.exe`, `powershell.exe`.
* **Infrastructure:**
* **C2 IP:** 157.20.182[.]49
* **SSH Tunneling IP:** 162.0.230[.]185
* **Usernames:** `asuedulimit` (used for SSH authentication).
## Implications
MuddyWater continues to be a high-tempo threat actor focused on regional rivals of Iran, particularly Israel. The use of DLL side-loading with legitimate, signed applications indicates a focus on bypassing traditional EDR/AV solutions. The presence of manual typos in command-line activity suggests a human-operated element rather than fully automated scripts, allowing for real-time adaptation during the intrusion.
## Mitigations
* **RDP Security:** Enforce Multi-Factor Authentication (MFA) and restrict RDP access behind a VPN or Gateway. Disable RDP on endpoints where not strictly necessary.
* **Binary Monitoring:** Monitor for unexpected executions of legitimate binaries like `FMAPP.exe` from non-standard locations (e.g., `C:\Users\Public\Downloads`).
* **Network Filtering:** Block or monitor outbound SSH traffic (Port 22) from unauthorized internal workstations, especially to known suspicious IP ranges.
* **PowerShell Logging:** Enable Enhanced Script Block Logging and Constrained Language Mode to detect and limit malicious PowerShell activity.
* **Hunt for Persistence:** Regularly audit active SSH tunnels and established network connections to unfamiliar external IPs.