New Developments in MuddyWater Attacks: Deploying BugSleep Malware Implanter

▌Use and Characteristics of BugSleep Malware

Recently, MuddyWater, an Iranian cyber espionage group, has demonstrated new shifts in its attack methodologies. They have begun partially employing a new custom malware implant named BugSleep, designed to steal files and execute commands on compromised systems.

BugSleep, this new backdoor, is believed to be still under active development, but analysts have already spotted it in phishing campaigns. Attackers use carefully crafted phishing emails masquerading as invitations to webinars or online courses to lure victims into clicking and downloading malicious payloads. Notably, some versions of BugSleep discovered in the wild are equipped with a custom malware loader. This loader is capable of subtly injecting malicious code into the active processes of a few applications, such as Microsoft Edge, Google Chrome, AnyDesk, etc., thereby achieving a more stealthy attack.

Multiple versions of the BugSleep malware have been found circulating, with differences between each version, indicating that the attackers are constantly making improvements and fixing bugs. This behavior of frequently updating malicious samples in a short period of time also reveals a trial-and-error strategy in MuddyWater's attack methods.

▌MuddyWater's Attack Scope and Strategic Upgrade

With BugSleep deployed, the MuddyWater hacking group is no longer entirely dependent on legitimate remote management tools to maintain access to victims' networks. This shift also marks a further upgrade in MuddyWater's attack techniques and strategies. This campaign using BugSleep targets a wide range of global entities, including government organizations and municipalities, airlines, and media institutions. Notably, Israel, as well as parts of Turkey, Saudi Arabia, India, and Portugal, have become primary targets for MuddyWater.

(BugSleep Attack Chain) MuddyWater (also known as Earth Vetala, MERCURY, Static Kitten, and Seedworm) first emerged in 2017. The group primarily targets Middle Eastern entities and has continuously upgraded its attack methods. Although this Iranian threat group is relatively new compared to other state-sponsored hacking groups, it is highly active, launching attacks across multiple industry sectors, including telecommunications, government, IT services, and oil industry organizations.

Since its emergence, MuddyWater has gradually expanded its attack footprint to government and defense entities in Central and Southwest Asia, as well as organizations in North America, Europe, and Asia, conducting cyber espionage. In February 2022, another malware associated with MuddyWater was tracked and discovered—a new Python backdoor named Small Sieve, used to maintain persistence and evade detection within compromised networks. The continuous evolution and upgrades of the MuddyWater hacking group signal the constant presence and shifting nature of cybersecurity threats. In light of this, SecOps Validation recommends that you must remain highly vigilant at all times and continuously reinforce your cybersecurity defenses to ensure you can effectively counter the evolving threat landscape.

▌SecOps Validation Rules

In response to the attack methods employed by this hacking group, the SecOps Security Metric Validation Platform has integrated corresponding attack simulation rules. You can search for the keyword "MuddyWater" in the platform to obtain attack simulation validation actions related to this threat group. Through these simulated attacks, you can verify whether your security defense system can effectively counter the group's attacks. The SecOps Security Metric Validation Platform utilizes an industry-unique method to ensure your validation process is completely safe and harmless.