MERCURY, an Iranian nation-state group, has recently been detected by Microsoft’s Threat Intelligence team operating under the guise of a ransomware attack in hybrid environments.
Since 2017, MERCURY has been conducting espionage campaigns against targets in the Middle East, and this state-sponsored group is financially motivated.
In their current ongoing operation, they are actively targeting both on-premises and cloud environments. As a result of the unrecoverable actions, the operation’s primary objectives were destruction and disruption.
The U.S. government has publicly connected MuddyWater (aka MERCURY) to the Ministry of Intelligence and Security (MOIS), a government agency in Iran linked to this group.
Other Names of MERCURY
While the cybersecurity community has tracked this group under several names, we have listed them below:-
- Boggy Serpens
- Cobalt Ulster
- Earth Vetala
- ITG17
- MuddyWater
- Seedworm
- Static Kitten
- TEMP.Zagros
- Yellow Nix
Microsoft found that MERCURY partnered with DEV-1084, a known cyber-espionage group, to execute lethal attacks. DEV-1084 acted after MERCURY gained access to the target environment.
Links Between DEV-1084 and MERCURY
Here below, we have mentioned all the key links between DEV-1084 and MERCURY:-
- DEV-1084 was observed sending threatening emails from an IP address (146.70.106[.]89) linked to MERCURY.
- DEV-1084 used the same VPN provider (MULLVAD VPN), historically used by MERCURY.
- DEV-1084 used Rport and a customized version of Ligolo, the tools that MERCURY also used in previous attacks.
- DEV-1084 used the vatacloud[.]com domain for command and control (C2) during the incident is the same domain that MERCURY operators control.
Technical Analysis
In Microsoft’s assessment, it has been observed that the MERCURY operators have exploited an unpatched internet-facing device to access the targets. DEV-1084 was then given access by Mercury to carry out the work.
Once the threat actors gain access, they use various tools and techniques to maintain persistence. At the same time, this allows them to maintain access to the compromised devices over an extended period.
After implementing this whole proceeding, the threat actors get the following abilities:-
- Installing web shells
- Adding a local user account and elevating privileges to the local administrator
- Installing legitimate remote access tools, such as RPort, Ligolo, and eHorus
- Installing a customized PowerShell script backdoor
- Stealing credentials
After compromising the highly privileged credentials, DEV-1084 subsequently exploited it to encrypt on-premise devices and delete large amounts of cloud elements like:-
- Server farms
- Virtual machines
- Storage accounts
- Virtual networks
Moreover, the malicious actors ultimately control email inboxes by exploiting the Exchange Web Services. Here, they utilize this access to carry out many search operations.
Through this, they detect the identity of a prominent organization member, enabling them to transmit messages to internal and external addressees.
The above-mentioned actions were estimated to have occurred over approximately three hours between 12:38 am in the morning and 3:21 am in the morning, which is the ending time.
DEV-1084, as of right now, cannot be confirmed to be an autonomous threat actor, nor can there be any concrete evidence to support the claim that it operates alongside other Iranian threat actors.
Struggling to Apply The Security Patch in Your System? –
Try All-in-One Patch Manager Plus
Related Read: