MuddyWater Continues Exploiting Log4Shell in Cyber War

Since its discovery in December 2021, the Log4Shell vulnerability has allowed threat actors to compromise organizations worldwide. Nine (9) months later, threat actors such as MuddyWater (a.k.a “Static Kitten”, “MERCURY”, “Seedworm”) continue to utilize the attack chain to compromise assets throughout the Israeli region. MuddyWater is a well-known Iranian threat organization that has compromised assets in telecommunications, IT services, and oil industries in the Middle East and European regions. Recently, MuddyWater began a new operation targeting Israeli corporate networks as a response to the ever-growing cyberwar between the two countries. MuddyWater has slightly shifted recently to targeting vulnerabilities within SysAid, a widely used Israeli IT management software. Once exploited, threat actors have the ability to drop additional tools to enable further reconnaissance, establish persistence, and facilitate lateral movement within the compromised network. Leveraging the unauthorized access, MuddyWater threat actors collect network information, Active Directory environment information, create administrator-level user accounts, and exfiltrate credentials from sensitive network resources to command-and-control (C2) servers. CTIX continues to monitor threat actor activity worldwide and will provide additional updates accordingly.