The Iranian cyber-espionage group referred to as MuddyWater continues to focus on long-running operations even after a U.S. airstrike killed General Qassem Soleimani on January 2.
Soleimani was the leader of Quds Force, an elite unit of the Iranian Revolutionary Guards, and his death resulted in escalated tensions between the United States and Iran, yet there have been no reports of cyber-attacks launched in retaliation.
Cyber-retaliation continues to be a probability, and even industrial systems might be at risk, but for now Iranian threat groups appear to focus on their long-running cyber-espionage activity instead, Secureworks’ security researchers say.
“Although there was ballistic missile bombardment of U.S. military personnel in Iraq […], no government-directed cyber retaliation has been observed as of this publication,” the security firm notes in a new report.
Looking into the activity associated with Iran-linked hackers, Secureworks observed that most operations commenced prior to the U.S. drone strike. The campaigns were conducted by MuddyWater, a threat group that is also referred to as COBALT ULSTER, Seedworm, TEMP.Zagros, and Static Kitten.
Active since at least 2017, the group was observed mainly targeting entities in the Middle East and the United States with spear-phishing attacks, and has evolved its toolset and tactics to avoid detection.
Between mid-2019 and mid-January 2020, the threat actor launched numerous spear-phishing attacks on governmental organizations in Turkey, Jordan, and Iraq, and also targeted global intergovernmental organizations and unknown entities in Georgia and Azerbaijan.
In one attack, the hackers sent numerous spear-phishing emails carrying malicious attachments, with some emails containing a link to a compromised site.
One of the infection chains featured Excel documents used with a malicious VBScript macro that would drop the legitimate wscript.exe binary, achieve persistence, and eventually fetch a second-stage PowerShell designed to download additional payloads from a hardcoded IP address.
A second infection chain employed Excel files with an obfuscated macro designed to drop and execute a previously unobserved remote access Trojan (RAT). Referred to as ForeLord, the malware uses DNS tunneling.
The threat actor deployed several tools onto the compromised host, to collect and test credentials, and create a reverse SSL tunnel for expanded access to the network. These include PasswordDumper, a Mimikatz variant named Caller.dll, and open-source tools CredNinja for credential testing, and Secure Socket Funneling for TCP and UDP port forwarding.
Many of the attacks MuddyWater launched over the past couple of years started with the collection of credentials via social engineering, phishing, password spraying, brute-force attacks, and exploitation of publicly available systems, the security researchers say.
“Although Iran has not launched a cyber-retaliation for Soleimani’s death as of this publication, CTU researchers acknowledge that planning and coordinating for a response takes time. Iran has destructive and disruptive capabilities that it has historically employed for retaliatory purposes against organizations. In some cases, these responses materialized several months after provocations toward Iran occurred. However, Iran’s cyberespionage operations continue,” Secureworks concludes.
Related: “MuddyWater” Cyberspies Update PowerShell Backdoor
Related: Targeted Phishing Campaign Leverages Death of Iranian General Qasem Suleimani
Related: Iran-Linked ZeroCleare Wiper Targets Energy, Industrial Sectors in Middle East

More from Ionut Arghire
- Former Ubiquiti Employee Who Posed as Hacker Pleads Guilty
- Atlassian Warns of Critical Jira Service Management Vulnerability
- Exploitation of Oracle E-Business Suite Vulnerability Starts After PoC Publication
- Google Shells Out $600,000 for OSS-Fuzz Project Integrations
- F5 BIG-IP Vulnerability Can Lead to DoS, Code Execution
- Flaw in Cisco Industrial Appliances Allows Malicious Code to Persist Across Reboots
- HeadCrab Botnet Ensnares 1,200 Redis Servers for Cryptomining
- Malicious NPM, PyPI Packages Stealing User Information
Latest News
- US Downs Chinese Balloon Off Carolina Coast
- Microsoft: Iran Unit Behind Charlie Hebdo Hack-and-Leak Op
- Feds Say Cyberattack Caused Suicide Helpline’s Outage
- Big China Spy Balloon Moving East Over US, Pentagon Says
- Former Ubiquiti Employee Who Posed as Hacker Pleads Guilty
- Cyber Insights 2023: Venture Capital
- Atlassian Warns of Critical Jira Service Management Vulnerability
- High-Severity Privilege Escalation Vulnerability Patched in VMware Workstation
