Saudi FM calls Indian, Pakistani counterparts to discuss developments    Al Hilal thrash Gwangju to reach AFC Champions League Elite semi-finals    Saudi Arabia cracks down on fraudulent Hajj campaigns, urges pilgrims to use official channels    Nammos Amala Resort to open soon with Saudi-Greek designs    Saudi Arabia completes 674 Vision 2030 initiatives, achieves 93% of KPIs as ninth-year milestone marked    Literature Commission inaugurates Saudi Pavilion at Muscat Book Fair    Saudi Minister of Culture holds talks with his Costa Rican counterpart in Jeddah    Alkhorayef praises advancements in Al-Kharj food industries sector    MHRSD: 80% of recruitment offices are non-compliant with regulations    At least 50 Palestinians killed in Israeli strikes across Gaza    Teenage girl killed in French school stabbing attack    Trump claims meeting with China after Beijing denies any trade negotiations    GACA chief chairs 16th meeting of the Steering Committee on aviation's strategy    Saudi Theater Commission launches its Work and Learn Project in UK    The season has begun — and one comment shook us all    Jennifer Lopez dazzles in Jeddah with a Formula 1 performance    Saudi Arabia open to expanded 64-team World Cup in 2034, says sports minister    Average life expectancy in Saudi Arabia rises to78.8 years    Film Commission launches 'Cinema' initiative to enhance content    Famed Philippine film star Nora Aunor dies at 71    Pakistani star's Bollywood return excites fans and riles far right    Veteran Bollywood actor Manoj Kumar dies at 87    Bollywood actress vindicated over boyfriend's death after media hounding    Grand Mufti rules against posting prayers and preaching in mosques on social media    Exotic Taif Roses Simulation Performed at Taif Rose Festival    Asian shares mixed Tuesday    Weather Forecast for Tuesday    Saudi Tourism Authority Participates in Arabian Travel Market Exhibition in Dubai    Minister of Industry Announces 50 Investment Opportunities Worth over SAR 96 Billion in Machinery, Equipment Sector    HRH Crown Prince Offers Condolences to Crown Prince of Kuwait on Death of Sheikh Fawaz Salman Abdullah Al-Ali Al-Malek Al-Sabah    HRH Crown Prince Congratulates Santiago Peña on Winning Presidential Election in Paraguay    SDAIA Launches 1st Phase of 'Elevate Program' to Train 1,000 Women on Data, AI    41 Saudi Citizens and 171 Others from Brotherly and Friendly Countries Arrive in Saudi Arabia from Sudan    Saudi Arabia Hosts 1st Meeting of Arab Authorities Controlling Medicines    General Directorate of Narcotics Control Foils Attempt to Smuggle over 5 Million Amphetamine Pills    NAVI Javelins Crowned as Champions of Women's Counter-Strike: Global Offensive (CS:GO) Competitions    Saudi Karate Team Wins Four Medals in World Youth League Championship    Third Edition of FIFA Forward Program Kicks off in Riyadh    Evacuated from Sudan, 187 Nationals from Several Countries Arrive in Jeddah    SPA Documents Thajjud Prayer at Prophet's Mosque in Madinah    SFDA Recommends to Test Blood Sugar at Home Two or Three Hours after Meals    SFDA Offers Various Recommendations for Safe Food Frying    SFDA Provides Five Tips for Using Home Blood Pressure Monitor    SFDA: Instant Soup Contains Large Amounts of Salt    Mawani: New shipping service to connect Jubail Commercial Port to 11 global ports    Custodian of the Two Holy Mosques Delivers Speech to Pilgrims, Citizens, Residents and Muslims around the World    Sheikh Al-Issa in Arafah's Sermon: Allaah Blessed You by Making It Easy for You to Carry out This Obligation. Thus, Ensure Following the Guidance of Your Prophet    Custodian of the Two Holy Mosques addresses citizens and all Muslims on the occasion of the Holy month of Ramadan    







Thank you for reporting!
This image will be automatically disabled when it gets reported by several people.



MuddyWater's attempts to disguise itself derailed
Published in The Saudi Gazette on 01 - 05 - 2019

The cyber-weapons used by Middle Eastern cyberespionage group, MuddyWater, reveal multiple ‘false flag' attempts to point the finger of attribution at Chinese, Russian, Turkish and Saudi Arabian threat actors and confuse security researchers and the authorities, according to an in-depth analysis of the cyber-arsenal by Kaspersky Lab.
MuddyWater is an advanced threat actor that first surfaced in 2017. In October 2018, Kaspersky Lab reported on a major operation by MuddyWater, targeting governmental and telecom targets entities in Saudi Arabia, Iraq, Jordan, Lebanon and Turkey as well as neighboring countries like Azerbaijan, Afghanistan and Pakistan. The malicious tools and infrastructure uncovered during this investigation show how the threat actor tried to confuse and distract investigators and the security industry – and also reveal a string of operational security failures that ultimately meant this approach failed.
In the first publicly available report on what happens to MuddyWater victims after initial infection, Kaspersky Lab researchers outline the various deception techniques implemented by the attackers. These include Chinese and Russian word strings in the malware code, the use of the filename ‘Turk', as well as attempts to impersonate the RXR Saudi Arabia hacking group.
The attackers appear to have been fairly well equipped to achieve their intended goals. Most of the malicious tools discovered were relatively simple and expendable, Python and PowerShell-based tools, and were mainly developed in-house by the group. They seemed to have allowed the attackers flexibility to adapt and customize the toolset for victims.
"MuddyWater's ability to continuously adjust and enhance its attacks to adapt to changes in the Middle Eastern geopolitical scene, have made this group a solid adversary that keeps growing," said Mohamad Amin Hasbini, Head of Global Research & Analysis team for META at Kaspersky Lab. "We expect it to keep developing and to acquire additional tools, maybe even zero-days. Nevertheless, its multiple operational mistakes betray an element of weakness, and provide investigators with trails that lead to important information," he added. — SG


Clic here to read the story from its source.