Hacker Group 'Moses Staff' Using New StrifeWater RAT In Ransomware Attacks

 

A politically motivated hacker group tied to a series of espionage and sabotage attacks on Israeli entities in 2021 incorporated a previously undocumented remote access trojan (RAT) that masquerades as the Windows Calculator app as part of a conscious effort to stay under the radar.

Cybersecurity company Cybereason, which has been tracking the operations of the Iranian actor known as Moses Staff, dubbed the malware "StrifeWater."

"The StrifeWater RAT appears to be used in the initial stage of the attack and this stealthy RAT has the ability to remove itself from the system to cover the Iranian group's tracks," Tom Fakterman, Cybereason security analyst, said in a report. "The RAT possesses other capabilities, such as command execution and screen capturing, as well as the ability to download additional extensions."

Moses Staff came to light towards the end of last year when Check Point Research unmasked a series of attacks aimed at Israeli organizations since September 2021 with the objective of disrupting the targets' business operations by encrypting their networks, with no option to regain access or negotiate a ransom.

The intrusions were notable for the fact that they relied on the open-source library DiskCryptor to perform volume encryption, in addition to infecting the systems with a bootloader that prevents them from starting without the correct encryption key.

To date, victims have been reported beyond Israel, including Italy, India, Germany, Chile, Turkey, the U.A.E., and the U.S.

The new piece of the attack puzzle discovered by Cybereason comes in the form of a RAT that's deployed under the name "calc.exe" (the Windows Calculator binary) and is used during the early stages of the infection chain, only to be removed prior to the deployment of the file-encrypting malware.

The removal and the subsequent replacement of the malicious calculator executable with the legitimate binary, the researchers suspect, is an attempt on the part of the threat actor to cover up tracks and erase evidence of the trojan, not to mention enable them to evade detection until the final phase of the attack when the ransomware payload is executed.

StrifeWater, for its part, is no different from its counterparts and comes with numerous features, chief among them being the ability to list system files, execute system commands, take screen captures, create persistence, and download updates and auxiliary modules.

"The end goal for Moses Staff appears to be more politically motivated rather than financial," Fakterman concluded. "Moses Staff employs ransomware post-exfiltration not for financial gain, but to disrupt operations, obfuscate espionage activity, and to inflict damage to systems to advance Iran's geopolitical goals."

Related news

1. Hack Tools Github
2. World No 1 Hacker Software
3. Pentest Tools
4. Hack Website Online Tool
5. Hacking Tools Name
6. Hack Website Online Tool
7. Hacks And Tools
8. Pentest Tools Linux
9. How To Make Hacking Tools
10. Hacker Tools List
11. Pentest Tools Android
12. Pentest Tools For Windows
13. Pentest Tools Linux
14. Hacker Tools Mac
15. Hacker Tools Software
16. Hack Apps
17. Hacking Tools Windows 10
18. Hacking Tools And Software
19. Hack Tools For Ubuntu
20. Github Hacking Tools
21. Hack App
22. Pentest Tools For Android
23. Underground Hacker Sites
24. Pentest Box Tools Download
25. Pentest Tools List
26. Hack Tools
27. Hacking App
28. How To Hack
29. Hacking Tools Pc
30. Hackers Toolbox
31. Hacking Tools For Windows 7
32. Pentest Tools For Windows
33. Pentest Tools Url Fuzzer
34. Hacking Tools Name
35. New Hack Tools
36. Wifi Hacker Tools For Windows
37. Hacker Tools For Ios
38. Nsa Hack Tools
39. Pentest Tools Online
40. Hack Apps
41. Free Pentest Tools For Windows
42. Nsa Hack Tools Download
43. Hacker Tools Free Download
44. Hacker Security Tools
45. Hacker Techniques Tools And Incident Handling
46. Hacks And Tools
47. Hacking Tools For Mac
48. Hacking Tools And Software
49. Tools Used For Hacking
50. How To Hack
51. Hack Tool Apk
52. How To Make Hacking Tools
53. Hacking Tools Mac
54. Hack Tool Apk
55. Hacker Tools Github
56. Pentest Tools Website
57. Black Hat Hacker Tools
58. Beginner Hacker Tools
59. What Is Hacking Tools
60. Pentest Tools Framework
61. New Hack Tools
62. Hacks And Tools
63. Easy Hack Tools
64. Hacking Tools Windows
65. Hacking Tools Hardware
66. Pentest Tools Kali Linux
67. Tools Used For Hacking
68. Hacker Tools Mac
69. How To Hack
70. Bluetooth Hacking Tools Kali
71. World No 1 Hacker Software
72. Hacker Tools Free
73. Hacking Tools 2019
74. What Are Hacking Tools
75. Pentest Automation Tools
76. Pentest Tools Android
77. Pentest Tools Find Subdomains
78. Tools 4 Hack
79. Hacker Search Tools
80. Pentest Tools Online
81. Hacker Tools For Windows
82. Hacker Tools 2019
83. Free Pentest Tools For Windows
84. Beginner Hacker Tools
85. Hacking Tools For Games
86. Hacking Tools And Software
87. Hacker Tools 2020
88. How To Make Hacking Tools
89. Best Hacking Tools 2019
90. Pentest Reporting Tools
91. Hacking Tools For Windows 7
92. Pentest Tools Download
93. Nsa Hacker Tools
94. Hacker Tools Software
95. Pentest Tools For Android
96. Pentest Recon Tools
97. Hacker Tools Apk Download
98. Hack Tools For Games
99. Hacker Tools Software
100. Hackrf Tools
101. Pentest Tools Port Scanner
102. Hacker Search Tools
103. Android Hack Tools Github
104. Hacking Tools For Windows
105. Hack And Tools
106. Hack App
107. Hacking Tools 2020
108. Pentest Tools Framework
109. Pentest Tools Review
110. Hack Tools Github
111. Hack Rom Tools
112. Hacking Tools For Windows 7
113. Hacking Tools Hardware
114. Hacking Tools For Kali Linux
115. Pentest Tools
116. Hacker Tools For Mac
117. Termux Hacking Tools 2019