Hacker Group 'Moses Staff' Using New StrifeWater RAT In Ransomware Attacks

 

A politically motivated hacker group tied to a series of espionage and sabotage attacks on Israeli entities in 2021 incorporated a previously undocumented remote access trojan (RAT) that masquerades as the Windows Calculator app as part of a conscious effort to stay under the radar.

Cybersecurity company Cybereason, which has been tracking the operations of the Iranian actor known as Moses Staff, dubbed the malware "StrifeWater."

"The StrifeWater RAT appears to be used in the initial stage of the attack and this stealthy RAT has the ability to remove itself from the system to cover the Iranian group's tracks," Tom Fakterman, Cybereason security analyst, said in a report. "The RAT possesses other capabilities, such as command execution and screen capturing, as well as the ability to download additional extensions."

Moses Staff came to light towards the end of last year when Check Point Research unmasked a series of attacks aimed at Israeli organizations since September 2021 with the objective of disrupting the targets' business operations by encrypting their networks, with no option to regain access or negotiate a ransom.

The intrusions were notable for the fact that they relied on the open-source library DiskCryptor to perform volume encryption, in addition to infecting the systems with a bootloader that prevents them from starting without the correct encryption key.

To date, victims have been reported beyond Israel, including Italy, India, Germany, Chile, Turkey, the U.A.E., and the U.S.

The new piece of the attack puzzle discovered by Cybereason comes in the form of a RAT that's deployed under the name "calc.exe" (the Windows Calculator binary) and is used during the early stages of the infection chain, only to be removed prior to the deployment of the file-encrypting malware.

The removal and the subsequent replacement of the malicious calculator executable with the legitimate binary, the researchers suspect, is an attempt on the part of the threat actor to cover up tracks and erase evidence of the trojan, not to mention enable them to evade detection until the final phase of the attack when the ransomware payload is executed.

StrifeWater, for its part, is no different from its counterparts and comes with numerous features, chief among them being the ability to list system files, execute system commands, take screen captures, create persistence, and download updates and auxiliary modules.

"The end goal for Moses Staff appears to be more politically motivated rather than financial," Fakterman concluded. "Moses Staff employs ransomware post-exfiltration not for financial gain, but to disrupt operations, obfuscate espionage activity, and to inflict damage to systems to advance Iran's geopolitical goals."

More articles

1. Github Hacking Tools
2. Hacker Security Tools
3. Hack Tool Apk No Root
4. Pentest Tools Nmap
5. Best Hacking Tools 2019
6. What Are Hacking Tools
7. Pentest Tools Subdomain
8. Tools For Hacker
9. What Is Hacking Tools
10. New Hacker Tools
11. Hacks And Tools
12. Tools For Hacker
13. Physical Pentest Tools
14. Hacking Apps
15. Hacker
16. Pentest Tools
17. Nsa Hack Tools Download
18. Best Hacking Tools 2019
19. Nsa Hacker Tools
20. Hacks And Tools
21. How To Install Pentest Tools In Ubuntu
22. Hack Tools Mac
23. Hacker Tools For Ios
24. Game Hacking
25. Nsa Hack Tools
26. Best Pentesting Tools 2018
27. Hack Tool Apk No Root
28. Growth Hacker Tools
29. Pentest Tools Subdomain
30. Hack Tools For Windows
31. Game Hacking
32. Github Hacking Tools
33. Hacker Tools Software
34. Hack Tools Github
35. Hacking Tools Download
36. Tools For Hacker
37. Hacker Tools List
38. Hacker Tools Software
39. Top Pentest Tools
40. Hacker Tools For Windows
41. Pentest Tools Github
42. How To Hack
43. Pentest Tools Alternative
44. Pentest Tools Website
45. Hacker Tools For Ios
46. How To Make Hacking Tools
47. Best Hacking Tools 2019
48. Hacking Tools Pc
49. Pentest Recon Tools
50. Hacking Tools For Windows
51. Hak5 Tools
52. Pentest Tools Framework
53. Pentest Tools For Windows
54. Hack Tools
55. Pentest Tools Subdomain
56. Nsa Hack Tools Download
57. Hacker Tools List
58. Pentest Tools Website
59. Hacker Tools Apk
60. Hack Tools
61. Pentest Tools Windows
62. Best Hacking Tools 2020
63. Growth Hacker Tools
64. Hacking Tools For Kali Linux
65. Hacking Tools Kit
66. Install Pentest Tools Ubuntu
67. Pentest Tools Review
68. Hacking Tools Name
69. Usb Pentest Tools