Procedure examples

MuddyWater has performed credential dumping with Mimikatz and procdump64.exe.

MuddyWater has performed credential dumping with LaZagne.

MuddyWater has performed credential dumping with LaZagne.

MuddyWater has used malware to collect the victim’s IP address and domain name.

MuddyWater has stored obfuscated JavaScript code in an image file named temp.jpg.

MuddyWater has used the .NET csc.exe tool to compile executables from downloaded C# code.

MuddyWater has used Daniel Bohannon’s Invoke-Obfuscation framework and obfuscated PowerShell scripts. The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands.

MuddyWater has used malware that can collect the victim’s username.

MuddyWater has disguised malicious executables and used filenames and Registry key names associated with Windows Defender.

MuddyWater has used C2 infrastructure to receive exfiltrated data.

MuddyWater has used malware that leveraged WMI for execution and querying host information.

MuddyWater has used a PowerShell backdoor to check for Skype connections on the target machine.

MuddyWater has used scheduled tasks to establish persistence.

MuddyWater has used malware to obtain a list of running processes on the system.

MuddyWater has used PowerShell for execution.

MuddyWater has used a custom tool for creating reverse shells.

MuddyWater has used VBScript files to execute its POWERSTATS payload, as well as macros.

MuddyWater has developed tools in Python including Out1.

MuddyWater has used JavaScript files to execute its POWERSTATS payload.

MuddyWater has used HTTP for C2 communications.

MuddyWater has stored a decoy PDF file within a victim's `%temp%` folder.

MuddyWater has used malware that can collect the victim’s OS version and machine name.

MuddyWater has used malware that checked if the ProgramData folder had folders or files with the keywords "Kasper," "Panda," or "ESET."

MuddyWater has used cmd.exe net user /domain to enumerate domain users.

MuddyWater has used NordVPN to proxy phishing emails, making them appear to originate from France.

MuddyWater has controlled POWERSTATS from behind a proxy network to obfuscate the C2 location. MuddyWater has used a series of compromised websites that victims connected to randomly to relay information to command and control (C2). MuddyWater has also used go-socks5 variants to bypass firewalls and Network Address Translation (NAT), to communicate with a hardcoded C2 server, and to exfiltrate data.

MuddyWater has used web services including OneHub to distribute remote access tools.

MuddyWater has used one C2 to obtain enumeration scripts and monitor web logs, but a different C2 to send data back.

MuddyWater has used malware that can upload additional files to the victim’s machine. MuddyWater has used PowerShell commands to install remote management and monitoring (RMM) software on the victim’s machine to conduct espionage and to exfiltrate data.

MuddyWater has used malware that can capture screenshots of the victim’s machine.

MuddyWater has used tools to encode C2 communications including Base64 encoding.

MuddyWater has used a Word Template, Normal.dotm, for persistence.

MuddyWater has decoded base64-encoded PowerShell, JavaScript, and VBScript.

MuddyWater has exploited the Microsoft Exchange memory corruption vulnerability (CVE-2020-0688).

MuddyWater has exploited the Office vulnerability CVE-2017-0199 for execution.

MuddyWater has distributed URLs in phishing e-mails that link to lure documents.

MuddyWater has attempted to get users to open malicious PDF attachment and to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails. Additionally, MuddyWater has used a Word document with a malicious Visual Basic for Applications (VBA) macro; when enabled, the CertificationKit.ini payload is constructed and executed.

MuddyWater has leveraged ClickFix type tactics enticing victims to copy and paste malicious PowerShell code.

MuddyWater has exploited the Microsoft Netlogon vulnerability (CVE-2020-1472).

MuddyWater has used CMSTP.exe and a malicious INF to execute its POWERSTATS payload.

MuddyWater has used mshta.exe to execute its POWERSTATS payload and to pass a PowerShell one-liner for execution.

MuddyWater has used malware that leveraged rundll32.exe in a Registry Run key to execute a .dll.

MuddyWater has leveraged RMM solutions including ScreenConnect, AteraAgent, SimpleHelp, Action1, Level, and PDQ to facilitate follow-on actions within compromised hosts to include data exfiltration.

MuddyWater has used a PowerShell backdoor to check for Skype connectivity on the target machine.

MuddyWater has used malware to check running processes against a hard-coded list of security tools often used by malware researchers.

MuddyWater has used compromised mailboxes within target organizations to send spearphishing emails.

MuddyWater has added Registry Run key KCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemTextEncoding to establish persistence.

MuddyWater uses various techniques to bypass UAC.

MuddyWater has run a tool that steals passwords saved in victim email.

MuddyWater has performed credential dumping with LaZagne and other tools, including by dumping passwords saved in victim email.