Trend Micro Muddy Water March 2021

MuddyWater has performed credential dumping with Mimikatz and procdump64.exe.

Out1 can copy files and Registry data from compromised hosts.

Out1 has the ability to encode data.

MuddyWater has used Daniel Bohannon’s Invoke-Obfuscation framework and obfuscated PowerShell scripts. The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands.

MuddyWater has used malware that can collect the victim’s username.

MuddyWater has used a PowerShell backdoor to check for Skype connections on the target machine.

MuddyWater has used PowerShell for execution.

Out1 can use native command line for execution.

MuddyWater has used VBScript files to execute its POWERSTATS payload, as well as macros.

MuddyWater has developed tools in Python including Out1.

Out1 can use HTTP and HTTPS in communications with remote hosts.

MuddyWater has used HTTP for C2 communications.

MuddyWater has used malware that can collect the victim’s OS version and machine name.

RemoteUtilities can enumerate files and directories on a target machine.

MuddyWater has used cmd.exe net user /domain to enumerate domain users.

MuddyWater has controlled POWERSTATS from behind a proxy network to obfuscate the C2 location. MuddyWater has used a series of compromised websites that victims connected to randomly to relay information to command and control (C2). MuddyWater has also used go-socks5 variants to bypass firewalls and Network Address Translation (NAT), to communicate with a hardcoded C2 server, and to exfiltrate data.

MuddyWater has used malware that can upload additional files to the victim’s machine. MuddyWater has used PowerShell commands to install remote management and monitoring (RMM) software on the victim’s machine to conduct espionage and to exfiltrate data.

RemoteUtilities can upload and download files to and from a target machine.

RemoteUtilities can take screenshots on a compromised host.

Out1 can parse e-mails on a target machine.

MuddyWater has used tools to encode C2 communications including Base64 encoding.

MuddyWater has distributed URLs in phishing e-mails that link to lure documents.

MuddyWater has attempted to get users to open malicious PDF attachment and to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails. Additionally, MuddyWater has used a Word document with a malicious Visual Basic for Applications (VBA) macro; when enabled, the CertificationKit.ini payload is constructed and executed.

RemoteUtilities can use Msiexec to install a service.

MuddyWater has leveraged RMM solutions including ScreenConnect, AteraAgent, SimpleHelp, Action1, Level, and PDQ to facilitate follow-on actions within compromised hosts to include data exfiltration.

MuddyWater has used a PowerShell backdoor to check for Skype connectivity on the target machine.

MuddyWater has added Registry Run key KCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemTextEncoding to establish persistence.

MuddyWater has performed credential dumping with LaZagne and other tools, including by dumping passwords saved in victim email.

MuddyWater has run tools including Browser64 to steal passwords saved in victim web browsers.

MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients. MuddyWater has also sent spearphishing emails with the attachment Cybersecurity.doc, which served as the primarily payload for the next stage.

MuddyWater has sent targeted spearphishing e-mails with malicious links.

MuddyWater has used file sharing services including OneHub, Sync, and TeraBox to distribute tools.

MuddyWater can disable the system's local proxy settings.