Friday, March 29, 2024

MERCURY – A Destructive Operation From Iranian Hackers Wipe Cloud Environments

MERCURY, an Iranian nation-state group, has recently been detected by Microsoft’s Threat Intelligence team operating under the guise of a ransomware attack in hybrid environments.

Since 2017, MERCURY has been conducting espionage campaigns against targets in the Middle East, and this state-sponsored group is financially motivated.

In their current ongoing operation, they are actively targeting both on-premises and cloud environments. As a result of the unrecoverable actions, the operation’s primary objectives were destruction and disruption.

The U.S. government has publicly connected MuddyWater (aka MERCURY) to the Ministry of Intelligence and Security (MOIS), a government agency in Iran linked to this group.

Other Names of MERCURY

While the cybersecurity community has tracked this group under several names, we have listed them below:-

  • Boggy Serpens
  • Cobalt Ulster
  • Earth Vetala
  • ITG17
  • MuddyWater
  • Seedworm
  • Static Kitten
  • TEMP.Zagros
  • Yellow Nix

Microsoft found that MERCURY partnered with DEV-1084, a known cyber-espionage group, to execute lethal attacks. DEV-1084 acted after MERCURY gained access to the target environment.

Links Between DEV-1084 and MERCURY

Here below, we have mentioned all the key links between DEV-1084 and MERCURY:-

  • DEV-1084 was observed sending threatening emails from an IP address (146.70.106[.]89) linked to MERCURY.
  • DEV-1084 used the same VPN provider (MULLVAD VPN), historically used by MERCURY.
  • DEV-1084 used Rport and a customized version of Ligolo, the tools that MERCURY also used in previous attacks.
  • DEV-1084 used the vatacloud[.]com domain for command and control (C2) during the incident is the same domain that MERCURY operators control.

Technical Analysis

In Microsoft’s assessment, it has been observed that the MERCURY operators have exploited an unpatched internet-facing device to access the targets. DEV-1084 was then given access by Mercury to carry out the work.

Once the threat actors gain access, they use various tools and techniques to maintain persistence. At the same time, this allows them to maintain access to the compromised devices over an extended period.

After implementing this whole proceeding, the threat actors get the following abilities:-

  • Installing web shells
  • Adding a local user account and elevating privileges to the local administrator
  • Installing legitimate remote access tools, such as RPort, Ligolo, and eHorus
  • Installing a customized PowerShell script backdoor
  • Stealing credentials

After compromising the highly privileged credentials, DEV-1084 subsequently exploited it to encrypt on-premise devices and delete large amounts of cloud elements like:-

  • Server farms
  • Virtual machines
  • Storage accounts
  • Virtual networks

Moreover, the malicious actors ultimately control email inboxes by exploiting the Exchange Web Services. Here, they utilize this access to carry out many search operations.

Through this, they detect the identity of a prominent organization member, enabling them to transmit messages to internal and external addressees.

The above-mentioned actions were estimated to have occurred over approximately three hours between 12:38 am in the morning and 3:21 am in the morning, which is the ending time.

DEV-1084, as of right now, cannot be confirmed to be an autonomous threat actor, nor can there be any concrete evidence to support the claim that it operates alongside other Iranian threat actors.

Struggling to Apply The Security Patch in Your System? – 
Try All-in-One Patch Manager Plus

Related Read:

Website

Latest articles

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles