Researchers Detect Attack That Muddies Up Phishing Detection

Researchers at Palo Alto Networks have discovered some malicious files that have links to those that targeted the Saudi Arabian government earlier this year. They also seem to resemble some attacks on other countries in the Middle East, as well as some countries not in the area, including the United States and India. Researchers are referring to this series of attacks, which has been ongoing since February of this year, as MuddyWater. That’s because the whole thing is kind of "muddy.'

The method of delivery for these attacks is what is of particular note. A document (.doc) file is sent to a recipient that causes him or her to enable macros. That executes malware. While this is an old trick, the twist is that the document sent seems to be a modified copy of an actual document that the sender had intended to send to the recipient, but the attackers sent it first. So, the recipient is indeed expecting the document and therefore doesn’t hesitate to open it. This leads one to believe the hackers have breached the sender’s organization first and chose the target based on documents found on that network.

Phishing is quite lucrative for bad actors. While many times, they merely want to sell the information on the dark web, this seems to be a very specific type of attack. While these researchers are unable to detect precisely what the attackers are after, it shows that phishing is most certainly evolving into something that we soon will not be able to defend against. Staying on top of current events and ongoing threats will be our best bet. And of course, any document that arrives in your inbox that asks for macros to be enabled should cause you to be suspicious and reconsider the validity of it. That’s really the best advice for this.

Some talk has surfaced that there is a link between MuddyWater and those of the threat actor group FIN7, which primarily focuses on restaurants, services, and the financial sector. However, Palo Alto Networks has not been able to definitively conclude this is the case. Their researchers believe MuddyWater is some type espionage. They just cannot get more specific about who is perpetrating them or why at this time.