Seedworm: Group Compromises Government Agencies, Oil & Gas, NGOs, Telecoms, and IT Firms

guest · Dec 10, 2018

Seedworm: Group Compromises Government Agencies, Oil & Gas, NGOs, Telecoms, and IT Firms
December 10, 2018
https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group

Symantec researchers have uncovered extensive insights into a cyber espionage group behind a recent series of cyber-attacks designed to gather intelligence on targets spread primarily across the Middle East as well as in Europe and North America.

The group, which we call Seedworm (aka MuddyWater), has been operating since at least 2017, with its most recent activity observed in December 2018.
Tactics and Tools
During the operations, the group used tools consistent with those leveraged during past intrusions including Powermud, a custom tool used by the Seedworm group, and customized PowerShell, LaZagne, and Crackmapexec scripts.

Choosing to rely on publicly available tools allows Seedworm to quickly update their operations by using code written by others and applying only small customizations.
Click to expand...

guest · Oct 22, 2020

Iranian Cyberattack Group Deploys New PowGoop Downloader Against Mideast Targets
October 21, 2020
https://www.darkreading.com/vulnera...loader-against-mideast-targets/d/d-id/1339232

An Iranian cyberattack group known as Seedworm — thought to be linked to Iran's government — has started using new tools, including a custom download utility and commodity ransomware, as part of their attacks on companies and government agencies in the broader Middle East region, according to Broadcom's Symantec division.

The use of the malicious program does not necessarily indicate a shift to ransomware-based cybercrime for the group, but rather an adoption of a broader variety of tactics for countering defensive measures, says Vikram Thakur, Symantec's technical director.

"Looking at Seedworm's history, it is apparent they've been focused on Middle East-based government organizations for years," he says.
Click to expand...

While the Thanos ransomware is a commodity program offered for sale in underground forums, the PowGoop backdoor program for downloading scripts is custom software made by the group, Symantec stated in its analysis. The company published more than 30 indicators of compromise in the analysis, about half of which related to PowGoop.

The researchers were only moderately confident, however, in attributing PowGoop to the Iranian state actor.

"Seedworm has been one of the most active Iran-linked groups in recent months, mounting apparent intelligence-gathering operations across the Middle East," Symantec researchers stated in their analysis.
Click to expand...

Symantec: Seedworm: Iran-Linked Group Continues to Target Organizations in the Middle East

Group continues to be highly active in 2020, while tentative links to recently discovered PowGoop tool suggest possible retooling
The Iran-linked espionage group Seedworm (aka MuddyWater) has been highly active in recent months, attacking a wide range of targets, including a large number of government organizations in the Middle East.
Click to expand...

Log in or Sign up

Seedworm: Group Compromises Government Agencies, Oil & Gas, NGOs, Telecoms, and IT Firms

guest Guest

guest Guest

Log in or Sign up

Seedworm: Group Compromises Government Agencies, Oil & Gas, NGOs, Telecoms, and IT Firms

guest Guest

guest Guest

Useful Searches